Junior Security Architect

Job Description:

The Security Architect is responsible for assessing, designing, reviewing, and governing security architectures across cloud infrastructure, enterprise applications, mobile applications, APIs, third-party SaaS platforms, and AI-enabled applications. The role ensures that security requirements are incorporated into solution architecture and design from the early stages of the development lifecycle through deployment and operations.

The architect will identify security risks, recommend risk-based controls, define reusable security patterns and reference architectures, and work with engineering and operations teams to ensure that solutions align with enterprise security policies, standards, and regulatory obligations.

Key Responsibilities:

• Conduct security architecture and design reviews for new applications, existing applications, technology transformations, cloud migrations, and major architectural changes.
• Assess architectures for web applications, mobile applications (Android and iOS), APIs, microservices, event-driven systems, serverless applications, containerized applications, and distributed systems.
• Review solution architecture diagrams, data-flow diagrams, trust boundaries, network flows, authentication mechanisms, authorization models, and technology dependencies.
• Identify security gaps, architectural weaknesses, attack surfaces, misconfigurations, and design-level risks.
• Define security requirements and recommend appropriate preventive, detective, and corrective controls.
• Evaluate solutions against enterprise security policies, technical standards, reference architectures, and security baselines.
• Document findings, risk ratings, remediation recommendations, compensating controls, and residual risks.
• Collaborate with solution architects, application teams, infrastructure teams, and business stakeholders to integrate security into solution design.

Cloud Security Architecture:

• Perform security architecture reviews across AWS, Microsoft Azure, Google Cloud Platform (GCP), Oracle Cloud Infrastructure (OCI), and hybrid or on-premises environments.
• Demonstrate a strong understanding of cloud service models, shared responsibility models, cloud-native services, landing zones, subscriptions/accounts, organizational hierarchies, and multi-account or multi-subscription architectures.
• Assess the security of IaaS, PaaS, cloud-native services, managed databases, storage services, serverless workloads, containers, Kubernetes, and platform services.
• Design secure cloud architectures incorporating network segmentation, private connectivity, secure service-to-service communication, encryption, identity controls, centralized logging, and monitoring.
• Evaluate cloud configurations for excessive permissions, public exposure, insecure management interfaces, insecure service configurations, and unintended trust relationships.
• Assess the security implications of hybrid-cloud connectivity, cross-account access, cross-subscription communication, third-party integrations, and multi-cloud deployments.
• Define and promote reusable cloud security patterns, approved architectural designs, and secure deployment blueprints.

Application, API and Mobile Application Security:

• Conduct security reviews for web applications, mobile applications, APIs, microservices, backend services, and enterprise application integrations.
• Understand common application security vulnerabilities, including injection, broken access control, authentication weaknesses, insecure session management, insecure data handling, and security misconfiguration.
• Review application authentication and authorization flows, token handling, session lifecycle, API exposure, and service-to-service communication.
• Assess mobile application security risks, including insecure local storage, sensitive data leakage, certificate validation weaknesses, reverse engineering, insecure backend APIs, and compromised-device scenarios.
• Evaluate API gateway architectures, web application firewalls (WAFs), rate limiting, input validation, API authentication, authorization, and abuse prevention.
• Review security implications of application frameworks, third-party libraries, open-source components, software supply chains, and external integrations.
• Translate application security findings from penetration testing, SAST, DAST, SCA, and API security testing into actionable architecture improvements.
• Apply secure software development lifecycle (SSDLC) principles and integrate security requirements into design, development, testing, and deployment.

AI Application and Emerging Technology Security:

• Conduct security architecture reviews for AI-powered applications, large language model (LLM) solutions, retrieval-augmented generation (RAG), AI agents, and enterprise AI integrations.
• Evaluate AI application architectures involving model providers, AI platforms, embedding services, vector databases, data pipelines, orchestration frameworks, and external tools.
• Assess risks such as prompt injection, sensitive information disclosure, insecure output handling, excessive agency, insecure tool execution, and improper trust in model outputs.
• Review AI agent and Model Context Protocol (MCP) architectures, including tool permissions, authentication, authorization, input and output validation, and execution boundaries.
• Assess security controls for model access, AI gateways, API endpoints, model registries, prompts, embeddings, vector stores, and AI-related data flows.
• Evaluate AI integration patterns involving enterprise identity providers, OAuth 2.0, OpenID Connect (OIDC), API keys, managed identities, and workload identities.
• Define security requirements for AI application onboarding, approved AI services, third-party AI tools, AI governance, and production deployment.
• Apply relevant AI security frameworks and guidance, including the NIST AI Risk Management Framework and OWASP guidance for LLM applications.

Identity and Access Management (IAM), OAuth and API Security:

• Demonstrate strong knowledge of cloud IAM concepts, identity federation, role-based access control (RBAC), attribute-based access control (ABAC), privileged access management (PAM), and workload identities.
• Understand the critical role of IAM in cloud security and its impact on the security of applications, infrastructure, APIs, data, and administrative operations.
• Review authentication and authorization architectures involving enterprise identity providers, SSO, SAML 2.0, OAuth 2.0, OpenID Connect (OIDC), and modern federation protocols.
• Understand OAuth flows, including Authorization Code with PKCE, Client Credentials, token issuance, access-token validation, refresh tokens, scopes, consent, and token lifecycle management.
• Assess how applications securely obtain, store, use, rotate, and revoke client credentials, access tokens, refresh tokens, certificates, and API keys.
• Review identity federation and cross-account or cross-tenant access, including trust policies, role assumptions, managed identities, and service principals.
• Identify excessive permissions, overprivileged service accounts, shared identities, insecure trust relationships, hard-coded credentials, and inappropriate privilege escalation paths.
• Design and recommend least-privilege access models, just-in-time access, strong authentication, privileged access controls, and periodic access reviews.
• Evaluate OAuth-based integrations between enterprise applications, cloud-hosted workloads, and third-party SaaS providers.

Cloud Networking Security:

• Assess cloud network architectures, including virtual networks, VPCs, subnets, routing, security groups, network ACLs, firewalls, and network segmentation.
• Review hub-and-spoke architectures, transit connectivity, hybrid-cloud networking, VPNs, dedicated private connections, and inter-cloud connectivity.
• Evaluate private endpoints, private service access, public IP exposure, ingress and egress paths, DNS security, and service-to-service communication.
• Review WAF, API gateway, reverse proxy, load balancer, CDN, and DDoS protection designs.
• Understand Zero Trust network architecture and the application of identity-aware access, explicit verification, least privilege, and continuous assessment.
• Identify network attack paths, exposed management interfaces, unrestricted outbound access, insecure routing, and unintended paths that could bypass approved security gateways.
• Recommend network security controls that align with application architecture, business requirements, and risk exposure.

Third-Party SaaS Security Architecture and Assessments:

• Conduct security assessments of third-party SaaS applications before onboarding, integration, significant architectural changes, and production deployment.
• Assess SaaS architecture, authentication, SSO, provisioning, authorization, API integrations, data storage, encryption, tenant isolation, logging, and administrative access.
• Evaluate SaaS integration patterns using OAuth 2.0, OIDC, SAML, SCIM, API keys, certificates, webhooks, and service accounts.
• Determine whether required controls are supported natively by the SaaS provider or must be enforced through enterprise security services such as the identity provider, CASB/SSPM, SIEM, PAM, or API security gateways.
• Assess external attack surfaces, public endpoints, API exposure, network connectivity, data flows, and dependencies on subcontractors or other service providers.
• Review vendor security documentation, independent assurance reports, penetration-testing evidence, vulnerability management practices, incident response capabilities, and contractual security commitments.
• Identify gaps between vendor capabilities and enterprise security requirements; recommend remediation, compensating controls, risk acceptance, or rejection where necessary.
• Document SaaS security assessment results, applicability of controls, ownership, residual risks, and approval recommendations.

Threat Modelling and Risk Assessment:

• Conduct threat modelling for cloud infrastructure, application architectures, APIs, mobile applications, AI solutions, and third-party integrations.
• Identify assets, threat actors, entry points, trust boundaries, data flows, attack surfaces, abuse cases, and potential attack paths.
• Apply suitable threat-modelling methodologies such as STRIDE, attack trees, data-flow analysis, and scenario-based risk assessment.
• Analyse threats associated with misconfiguration, insecure identities, privilege escalation, data exfiltration, exposed services, compromised credentials, and supply-chain compromise.
• Evaluate threats associated with cloud control planes, management APIs, container platforms, serverless services, AI models, agentic workflows, and external tools.
• Assess likelihood, business impact, exploitability, exposure, and potential consequences to determine risk severity.
• Recommend risk-based controls and validate whether residual risk is acceptable.
• Maintain traceability between threats, identified risks, security requirements, remediation actions, and risk acceptance decisions.

Zero Trust Architecture and Secure Design Principles:

• Apply Zero Trust principles to cloud infrastructure, enterprise applications, APIs, workloads, and data access.
• Understand and implement secure design principles, including least privilege, defence in depth, secure defaults, fail-safe behaviour, separation of duties, complete mediation, and minimizing attack surface.
• Design identity-centric access models that authenticate and authorize users, devices, workloads, and services based on contextual and risk-based requirements.
• Apply segmentation, isolation, strong authentication, continuous monitoring, and explicit authorization to reduce lateral movement.
• Ensure that security controls are enforced at appropriate layers rather than relying solely on network perimeter defenses.
• Evaluate architectures for single points of failure, excessive trust, insecure dependencies, inadequate isolation, and weak security boundaries.
• Promote security-by-design and privacy-by-design throughout the solution lifecycle.

Cloud Security Governance, Policies and Standards:

• Develop, maintain, and implement enterprise cloud security policies, standards, technical baselines, reference architectures, and security patterns.
• Translate enterprise security policies into actionable technical requirements for cloud platforms, applications, data, IAM, networking, and operations.
• Establish and maintain security architecture review processes, approval criteria, security exceptions, risk acceptance workflows, and remediation tracking.
• Define control ownership and accountability across Security Architecture, Cloud Engineering, Application Engineering, IAM, DevOps, SOC, and business teams.
• Establish cloud security governance requirements for new services, cloud adoption, account or subscription onboarding, application deployment, and technology changes.
• Assess cloud security posture against defined baseline.

Skills

Architect, Architecture, Cloud, IAM, OAuth, OIDC, SAML, Security