Product Security Architect

Staffington Global; Bengaluru; On-site; INR 4,500,000 - 7,500,000; Full time

Job summary

Staffington Global is seeking a seasoned Architect to lead security assessment, design robust controls, and guide remediation strategies across product teams. You will identify risks, propose compensating controls, and ensure timely closure of security gaps.

The role requires 5+ years in information security, expertise in OWASP, CVSS, and DoD RMF, plus hands-on skills in SAST/DAST, PKI, and cloud security within a product environment. Healthcare domain experience is a plus.

Qualifications

• Globally recognized Cyber Security Certifications (Advanced/Expert Level).
• 5+ years of full-time information security experience with emphasis on technical assessment and security architecture design.

Responsibilities

• Identify risks and suggest remediation routes with compensatory controls.
• Guide product teams to closure of security issues.
• Work with OWASP, CVSS, FIPS, and DoD RMF.
• Perform and oversee SAST/DAST and vulnerability management activities.

Skills

Security certifications

Security architecture

Threat modeling

OWASP knowledge

PKI/CA

Penetration testing

SAST/DAST

Vulnerability management

Cloud security

Red teaming

Tools

SAST tools

DAST tools

Vulnerability scanners

SCA tools

Penetration testing tools

Job description

• The Architect shall be capable of not only finding risks/issues but shall also suggest the best route to remediation, knowing the compensatory controls & guiding the product team for its closure.

Qualifications

• Globally recognized Cyber Security Certifications (Advanced/Expert Level).
• 5+ years of full-time information security experience with emphasis on technical assessment (system/web application vulnerability assessment, penetration testing, white box secure code analysis, etc.) and security architecture (design of security controls, secure system design, understanding of identity and authentication management, etc.

Required Skills

• Mandatory Skills
• Security Engineering
• Firm with knowledge of OWASP, CVSS, FIPS 140-2/140-3 and DoD RMF.
• Sound understanding of security technologies/techniques like:
• Cryptography, Algorithms, Public key Infrastructure (PKI) Certificate Authority (CA),
• Hardware/embedded authentication, OAuth, 2-factor authentication, and
• white-box code analysis.
• Experience with a range of security tools related to:
• SAST (Static Application Security Assessment),
• DAST (Dynamic Application Security Assessment),
• Vulnerability Management,
• SCA (Software Composition Analysis),
• Penetration Testing
• Experience in working in a Product sector environment.
• Knowledge of Cloud Infrastructure [Platform as a Service].
• Security Engineering
• Penetration Testing in Web Applications, Thick Clients, Mobile Applications, REST/SOAP.
• Experience in Red Teaming Activities (add-on).
• Recognition for CVE or Wall-of-Fame through Bug-Bounty (add-o)

Preferred Skills

• Nice-to-have Skills
• Medical Software/Device Engineering
• MDS2 documentation.
• Experience in the Healthcare domain.
• Standard Software Engineering
• Experience in Micro Services using RESTful frameworks.