Identity Threat & Exposure (ITDR / ISPM) Service Architect

Atos; Bengaluru; On-site; INR 1,800,000 - 3,000,000; Full time

Job summary

Atos seeks an Identity Threat & Exposure Service Architect to lead end-to-end security architecture for identity protection, leveraging ITDR/ISPM platforms, SOC workflows, and MITRE ATT&CK mappings. You will design reference architectures, evaluate platforms, and define service definitions across on-prem and cloud environments.

The role requires hands-on experience with AD/Entra ID security, attack techniques, and detection/response automation.

Qualifications

• Architect and productise identity security services (reference architecture, platform evaluation, service definition)
• Deep knowledge of Active Directory and Microsoft Entra ID security internals (Kerberos, ACLs, delegation, tiering, conditional access, token model)
• Understand identity attack techniques mapped to MITRE ATT&CK (credential access, privilege escalation, lateral movement, persistence) and the telemetry
• Attack path analysis as graph problems, including cloud role escalation
• Hands-on with ITDR platforms (e.g., Defender for Identity, etc.)
• Hands-on with ISPM platforms (e.g., Radiant Logic, Veza, etc.)
• Detection engineering and behavioural baselining with mapping to MITRE ATT&CK
• Experience in response automation and containment design (SOAR playbooks)
• Security operations fluency and SOC alert-management experience

Skills

Identity security architecture

AD/Entra ID security internals

MITRE ATT&CK mapping

Graph-based attack path analysis

ITDR platform hands-on

ISPM platform hands-on

Detection engineering & baselining

SOAR & containment design

SOC operations fluency

Tools

Microsoft Defender for Identity

CrowdStrike Falcon Identity Protection

Silverfort

Semperis

Vectra AI

Radiant Logic

Veza

Tenable Identity Exposure

Splunk/Sentinel/KQL

Job description

Select how often (in days) to receive an alert:

Identity Threat & Exposure (ITDR / ISPM) Service Architect

Publication Date: Sep 28, 2026

Ref. No: 551738

Location:Bangalore, IN

Atos is the Atos Group brand dedicated to AI-powered, secure, end-to-end digital services. Atos designs, develops, and operates critical digital environments that drive performance, resilience and sovereignty, helping public and private organizations worldwide retain control over their data and infrastructures, while meeting regulatory requirements.

With more than 52,000 employees serving over 4,500 clients across 54 countries, Atos helps modernize core IT systems, accelerate cloud and data transformation, strengthen cybersecurity, and deliver secure digital workplace environments to support its clients, its employees and society. Atos also provides consulting and advisory services through its Atos Amplify brand.
A trusted partner in operating complex and mission-critical environments, Atos supports organizations across highly regulated and sovereign contexts.

Atos Group is a global leader in digital transformation with c. 54,000 employees and annual revenue of c. €7.2 billion, operating in 54 countries under two brands - Atos for services and Eviden for products and systems. European number one in cybersecurity and a leader in cloud, Atos Group is committed to a secure and decarbonized future and provides tailored AI-powered, end-to-end solutions for all industries. Atos Group is listed on Euronext Paris.

Must have skills

• Architected and productised identity security services (reference architecture, platform evaluation and selection, service definition), not implementation only
• Active Directory and Microsoft Entra ID security internals (Kerberos, ACLs, delegation, tiering, conditional access, token model); Okta an advantage
• Identity attack techniques at reproduction depth, mapped to MITRE ATT&CK credential access, privilege escalation, lateral movement and persistence (Kerberoasting, pass-the-hash/ticket, DCSync, ADCS abuse, token theft and replay, MFA fatigue, OAuth and consent abuse), and the telemetry each leaves
• Attack path analysis as a graph problem, including cloud role escalation (BloodHound, PingCastle, Purple Knight)
• ITDR platforms: hands-on with at least one of Microsoft Defender for Identity, CrowdStrike Falcon Identity Protection, Silverfort, Semperis, Vectra AI
• ISPM platforms: hands-on with at least one of Radiant Logic, Semperis, Veza, Tenable Identity Exposure, Silverfort
• Detection engineering and behavioural baselining (Sentinel/KQL, Splunk, Sigma), with detection coverage mapped to MITRE ATT&CK and false-positive management
• Response automation and containment design: SOAR playbooks, API-level containment actions, containment authority model
• Security operations fluency: has introduced detection content or containment authority into a SOC and can hold the alert-quality conversation

Good to have

• Threat hunting and deception design (honeytokens, decoy accounts)
• Exposure management platforms (Tenable One, Microsoft Security Exposure Management, Wiz)
• PAM platforms at API level (Idira/CyberArk, BeyondTrust) as signal and containment lever
• NIS2 and DORA incident reporting obligations; GDPR constraints on behavioural monitoring

Here at Atos, diversity and inclusion are embedded in our DNA. Read more about our commitment to a fair work environment for all.

Atos is a recognized leader in its industry across Environment, Social and Governance (ESG) criteria. Find out more on our CSR commitment.