Security Architect

HCLSoftware; Bengaluru; On-site; INR 4,000,000 - 8,000,000; Full time

Job summary

HCLSoftware seeks an accomplished Senior Security Architect to lead Secure Design and Supply Chain Security across the organization. The role will shape secure design decisions, influence architectures, and elevate security standards enterprise-wide.

The ideal candidate combines a strong development background with expert cybersecurity principles and hands-on delivery in container security, SBOM pipelines, and enterprise code signing.

Qualifications

• 10+ years of relevant experience spanning cybersecurity, application security, software engineering, or secure software development.
• Significant hands-on software development experience, with depth in at least one major language ecosystem (Java, JS/TS, C/C++, Go, Python) and the ability to assess unfamiliar codebases and architectures.
• Demonstrated experience leading threat modeling, security architecture reviews, and remediation discussions with engineering teams.
• Proven experience with container security (Linux kernel primitives, Kubernetes) and securing cloud application architectures.
• Strong command of software supply chain security, artifact authentication, and enterprise management of secrets, keys, and cryptographic assets.
• Demonstrated expertise operationalizing Software Bill of Materials (SBOM) pipelines (e.g., Dependency-Track) and mitigating open-source supply chain risks.
• Experience integrating AI tooling and automation into CI/CD pipelines, code analysis, architecture reviews, and threat modeling workflows.
• Strong written and technical communication skills, with the ability to clearly document complex threats and architectural guidance independently.
• Strong leadership and interpersonal skills to manage priority shifts, act as an operational shield for engineering teams, and navigate high-stakes technical conversations.

Responsibilities

• Rapid architectural triage: Quickly unpack unfamiliar product architectures across diverse ecosystems (Java, JS/TS, C/C++, Go, Python), identify systemic risks, and provide security guidance.
• Code-to-cloud security: Deep understanding of container security up through Kubernetes and hyperscaler patterns for securing applications.
• Adversarial perspective: Evaluate designs from an attacker's lens to identify holes in trust boundaries and multi-tier architectures; find issues before shipment.
• Supply chain security, cryptography & DevSecOps: Manage software supply chain security, artifact authentication, and enterprise Secrets/keys management.
• SBOM and open source fluency: Operationalize SBOM pipelines and mitigate open-source risks like typosquatting and dependency confusion.
• Enterprise code signing and CLM: Deploy, automate, and maintain enterprise code signing and Certificate Lifecycle Management platforms.
• Applied AI & security automation: Integrate AI tooling into CI/CD, code analysis, architecture reviews, and threat modeling workflows.
• Leadership, communication & execution: Coordinate with senior engineering leaders and product managers, translating priorities into protected sprint goals.

Skills

Threat modeling

Security architecture

Software development

Container security

Kubernetes

SBOM pipelines

Dependency-Track

Code signing

AI tooling

Open-source risk

Jira

Garasign

Qwen

Gemma

Tools

Jira

Garasign

Qwen

Gemma

Job description

HCLSoftware is seeking an accomplished security expert as Senior Security Architect to design our Secure Design and Supply Chain Security operations program. The successful candidate will act as the senior most expert within the organization on Secure Design and Supply Chain Security. The candidate will shape and influence design decisions and set the bar across the organization.

The ideal candidate will have a strong development background combined with an expert understanding of cybersecurity principles.

Key Responsibilities

• Rapid architectural triage: Demonstrated ability to quickly unpack unfamiliar product architectures across diverse ecosystems (Java, JS/TS, C/C++, Go, Python), identify systemic risks, and provide pragmatic security guidance.
• Code-to-cloud security: Deep understanding of container security (from Linux kernel primitives up through Kubernetes) and common hyperscaler patterns for securing applications.
• Adversarial perspective: Ability to look at designs through an attacker's lens to poke holes in assumptions, trust boundaries, and multi-tier architectures during the design and coding phases. Ability to find issues before they ship.

Supply Chain Security, Cryptography & DevSecOps

• Supply chain and cryptography: Strong command of software supply chain security, artifact authentication, and the enterprise management of secrets, keys, and high-value cryptographic assets.
• Hacker/builder mindset: Active or recent development background. Comfortable writing glue code and building pragmatic internal solutions rather than waiting for expensive, off-the-shelf commercial software.
• SBOM and open source fluency: Experience operationalizing SBOM pipelines (e.g., Dependency-Track) and a deep understanding of open-source risks like typosquatting and dependency confusion.
• Enterprise code signing and CLM: Hands-on experience deploying, automating, and maintaining enterprise-scale code signing systems and Certificate Lifecycle Management (CLM) platforms.

Applied AI & Security Automation

• DevSecOps w/ AI experience: Command of modern CI/CD pipelines with knowledge of how AI tooling can be integrated into architecture reviews, code analysis, and threat modeling workflows.
• Individual technical communication: Strong written communication skills. Able to dissect complex security designs and document nuanced threats independently without relying on superficial, AI-generated filler.
• Open weight model use: Experience exploring, benchmarking, or deploying open-source AI models (e.g., Qwen, Gemma) for internal automation, static analysis, vulnerability triage, or cost-efficient security operations.
• AI threat surfaces/defenses: Understanding of novel attack patterns targeting AI-enabled applications (prompt injection, model tampering, training data risks, and AI supply chain dependencies).

Leadership, Strategic Buffer & Execution

• Strategic buffer and priority management: Proven ability to act as an operational shield for a small team – absorbing executive priority shifts, triaging ad-hoc tangents, and translating ambiguous directives into clear, protected sprint goals.
• Influence and political acumen: Exceptional interpersonal skills with the confidence to navigate difficult, high-stakes conversations with senior engineering leadership and product managers about risk vs. velocity tradeoffs.
• High-concurrency execution: Thrives as a scrappy "player/coach". Skilled at using Jira to aggressively track and deliver across a massive backlog of concurrent initiatives, while remaining comfortable jumping into the weeds to help troubleshoot technical blockers.

Required Qualifications

• 10+ years of relevant experience spanning cybersecurity, application security, software engineering, or secure software development.
• Significant hands-on software development experience, with depth in at least one major language ecosystem (Java, JS/TS, C/C++, Go, Python) and the ability to assess unfamiliar codebases and architectures.
• Demonstrated experience leading threat modeling, security architecture reviews, and remediation discussions with engineering teams.
• Proven experience with container security (Linux kernel primitives, Kubernetes) and securing cloud application architectures.
• Strong command of software supply chain security, artifact authentication, and enterprise management of secrets, keys, and cryptographic assets.
• Demonstrated expertise operationalizing Software Bill of Materials (SBOM) pipelines (e.g., Dependency-Track) and mitigating open-source supply chain risks.
• Experience integrating AI tooling and automation into CI/CD pipelines, code analysis, architecture reviews, and threat modeling workflows.
• Strong written and technical communication skills, with the ability to clearly document complex threats and architectural guidance independently.
• Strong leadership and interpersonal skills to manage priority shifts, act as an operational shield for engineering teams, and navigate high-stakes technical conversations.

Preferred Qualifications

• Strong adversarial perspective to identify architectural vulnerabilities, trust boundary assumptions, and design flaws prior to shipment.
• Hands-on experience deploying, automating, and maintaining enterprise-scale code signing systems (e.g., Garasign) and Certificate Lifecycle Management (CLM) platforms.
• Experience exploring, benchmarking, or deploying open-weight AI models (e.g., Qwen, Gemma) for internal automation, static analysis, or vulnerability triage
• Understanding of novel attack surfaces and defense strategies targeting AI-enabled applications (prompt injection, model tampering, training data risks).