Security Architect

Tenarai; Bengaluru; On-site; INR 4,000,000 - 7,000,000; Full time

Job summary

Tenarai seeks an experienced security architecture engineer to secure our AWS platform and protect mission-critical workloads across the IRM product estate. You will design guardrails for accounts, landing zones, IAM/SCP, EKS security, network hardening, secrets management, and encryption patterns, with IaC guardrails enabling automated, auditable controls.

You will collaborate with CSA, CloudOps, DevOps, platform engineering, and PSOE product-security teams to drive posture improvements and

Qualifications

• Senior hands-on experience securing production AWS environments for client-facing or mission-critical workloads.
• Proven experience with AWS Organizations, multi-account architecture, landing zones, SCPs, IAM, VPC networking, EKS / Kubernetes, KMS, secrets management, and cloud logging.
• Practical experience turning cloud posture findings into remediated infrastructure and reusable patterns. Experience working with DevOps, CloudOps, platform engineering, and product teams in delivery-oriented environments.

Responsibilities

• Design and implement cloud security guardrails that allow engineering teams to move faster with less risk: AWS account structure, landing zones, IAM and SCP controls, EKS and container security, network exposure reduction, secrets and encryption patterns, cloud logging, posture management, and infrastructure-as-code guardrails.
• Report through CSA with day-to-day alignment to CloudOps, DevOps, platform engineering, and PSOE product-security resources.

Skills

AWS security

Multi-account AWS

IAM & SCPs

Terraform

CIS AWS Benchmarks

NIST CSF

Zero Trust

Kubernetes security

Tools

Terraform

Job description

Position Summary

This is a hands-on architecture and engineering role within Cybersecurity Architecture (CSA). The role secures the AWS platform behind the IRM product estate, including Horizon, CRC & OCN (Masscomm), and Legacy Masscomm platforms.

You will design and implement the cloud security guardrails that allow IRM engineering teams to move faster with less risk: AWS account structure, landing zones, IAM and SCP controls, EKS and container security, network exposure reduction, secrets and encryption patterns, cloud logging, posture management, and infrastructure-as code guardrails.

This role reports through CSA, with dedicated day-to-day alignment to CloudOps, DevOps, platform engineering, and the product-security resources in PSOE.

Required Qualifications

Experience

• Senior hands-on experience securing production AWS environments for client-facing or mission-critical workloads.
• Proven experience with AWS Organizations, multi-account architecture, landing zones, SCPs, IAM, VPC networking, EKS / Kubernetes, KMS, secrets management, and cloud logging.
• Practical experience turning cloud posture findings into remediated infrastructure and reusable patterns. Experience working with DevOps, CloudOps, platform engineering, and product teams in delivery-oriented environments.

Technical Skills

• Strong AWS architecture and security engineering skills.
• Infrastructure-as-code and policy-as-code experience, preferably with Terraform or equivalent tooling. Working knowledge of CSPM / CNAPP concepts, container security, cloud detection, and cloud resilience. Ability to design controls that are automated, auditable, and usable by engineering teams.
• Familiarity with CIS AWS Benchmarks, NIST CSF, NIST SP 800-53, and Zero Trust concepts.

Soft Skills and Behaviours

• Practical architecture judgment: able to reduce real risk without creating review bottlenecks.
• Strong communication with platform engineers, product leaders, CyberOps, GRC, and executives.
• Comfortable operating through influence in a federated environment.
• Bias toward reusable patterns, measurable remediation, and clear ownership.

Certifications (Preferred)

• AWS Security - Specialty, AWS Solutions Architect Professional, or equivalent cloud-security credentials.
• CISSP, CCSP, Kubernetes security, or infrastructure-security certifications are assets.