{"id":3953204,"url":"https://alion.io/job/7elevengsc-junior-security-architect","title":"Junior Security Architect","company":{"id":1047705,"name":"7Elevengsc","domain":"7-elevengsc.com","url":"https://alion.io/company/7elevengsc","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"iCIMS","truth_index":null},"role":"Security","role_family":"Security","seniority":"junior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Bengaluru, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agentic Workflows","optional":false},{"name":"AI Agents","optional":false},{"name":"API Gateway","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"DNS","optional":false},{"name":"Embeddings","optional":false},{"name":"GCP","optional":false},{"name":"IAM","optional":false},{"name":"Kubernetes","optional":false},{"name":"Least Privilege","optional":false},{"name":"LLM","optional":false},{"name":"Model Context Protocol","optional":false},{"name":"NIST AI RMF","optional":false},{"name":"OWASP","optional":false},{"name":"RAG","optional":false},{"name":"SIEM","optional":false},{"name":"STRIDE","optional":false},{"name":"Zero Trust","optional":false}],"status":"live","first_seen_at":"2026-11-09T05:35:00Z","employer_posted_date":null,"last_verified_at":"2026-11-09T05:35:00Z","board_verified":false,"closed_at":null,"days_open":0,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":0},"description":"Job Description:\n\nThe Security Architect is responsible for assessing, designing, reviewing, and governing security architectures across cloud infrastructure, enterprise applications, mobile applications, APIs, third-party SaaS platforms, and AI-enabled applications. The role ensures that security requirements are incorporated into solution architecture and design from the early stages of the development lifecycle through deployment and operations.\n\nThe architect will identify security risks, recommend risk-based controls, define reusable security patterns and reference architectures, and work with engineering and operations teams to ensure that solutions align with enterprise security policies, standards, and regulatory obligations.\n\nKey Responsibilities:\nConduct security architecture and design reviews for new applications, existing applications, technology transformations, cloud migrations, and major architectural changes.\nAssess architectures for web applications, mobile applications (Android and iOS), APIs, microservices, event-driven systems, serverless applications, containerized applications, and distributed systems.\nReview solution architecture diagrams, data-flow diagrams, trust boundaries, network flows, authentication mechanisms, authorization models, and technology dependencies.\nIdentify security gaps, architectural weaknesses, attack surfaces, misconfigurations, and design-level risks.\nDefine security requirements and recommend appropriate preventive, detective, and corrective controls.\nEvaluate solutions against enterprise security policies, technical standards, reference architectures, and security baselines.\nDocument findings, risk ratings, remediation recommendations, compensating controls, and residual risks.\nCollaborate with solution architects, application teams, infrastructure teams, and business stakeholders to integrate security into solution design.\n\nCloud Security Architecture:\nPerform security architecture reviews across AWS, Microsoft Azure, Google Cloud Platform (GCP), Oracle Cloud Infrastructure (OCI), and hybrid or on-premises environments.\nDemonstrate a strong understanding of cloud service models, shared responsibility models, cloud-native services, landing zones, subscriptions/accounts, organizational hierarchies, and multi-account or multi-subscription architectures.\nAssess the security of IaaS, PaaS, cloud-native services, managed databases, storage services, serverless workloads, containers, Kubernetes, and platform services.\nDesign secure cloud architectures incorporating network segmentation, private connectivity, secure service-to-service communication, encryption, identity controls, centralized logging, and monitoring.\nEvaluate cloud configurations for excessive permissions, public exposure, insecure management interfaces, insecure service configurations, and unintended trust relationships.\nAssess the security implications of hybrid-cloud connectivity, cross-account access, cross-subscription communication, third-party integrations, and multi-cloud deployments.\nDefine and promote reusable cloud security patterns, approved architectural designs, and secure deployment blueprints.\n\nApplication, API and Mobile Application Security:\nConduct security reviews for web applications, mobile applications, APIs, microservices, backend services, and enterprise application integrations.\nUnderstand common application security vulnerabilities, including injection, broken access control, authentication weaknesses, insecure session management, insecure data handling, and security misconfiguration.\nReview application authentication and authorization flows, token handling, session lifecycle, API exposure, and service-to-service communication.\nAssess mobile application security risks, including insecure local storage, sensitive data leakage, certificate validation weaknesses, reverse engineering, insecure backend APIs, and compromised-device scenarios.\nEvaluate API gateway architectures, web application firewalls (WAFs), rate limiting, input validation, API authentication, authorization, and abuse prevention.\nReview security implications of application frameworks, third-party libraries, open-source components, software supply chains, and external integrations.\nTranslate application security findings from penetration testing, SAST, DAST, SCA, and API security testing into actionable architecture improvements.\nApply secure software development lifecycle (SSDLC) principles and integrate security requirements into design, development, testing, and deployment.\n\nAI Application and Emerging Technology Security:\nConduct security architecture reviews for AI-powered applications, large language model (LLM) solutions, retrieval-augmented generation (RAG), AI agents, and enterprise AI integrations.\nEvaluate AI application architectures involving model providers, AI platforms, embedding services, vector databases, data pipelines, orchestration frameworks, and external tools.\nAssess risks such as prompt injection, sensitive information disclosure, insecure output handling, excessive agency, insecure tool execution, and improper trust in model outputs.\nReview AI agent and Model Context Protocol (MCP) architectures, including tool permissions, authentication, authorization, input and output validation, and execution boundaries.\nAssess security controls for model access, AI gateways, API endpoints, model registries, prompts, embeddings, vector stores, and AI-related data flows.\nEvaluate AI integration patterns involving enterprise identity providers, OAuth 2.0, OpenID Connect (OIDC), API keys, managed identities, and workload identities.\nDefine security requirements for AI application onboarding, approved AI services, third-party AI tools, AI governance, and production deployment.\nApply relevant AI security frameworks and guidance, including the NIST AI Risk Management Framework and OWASP guidance for LLM applications.\n\nIdentity and Access Management (IAM), OAuth and API Security:\nDemonstrate strong knowledge of cloud IAM concepts, identity federation, role-based access control (RBAC), attribute-based access control (ABAC), privileged access management (PAM), and workload identities.\nUnderstand the critical role of IAM in cloud security and its impact on the security of applications, infrastructure, APIs, data, and administrative operations.\nReview authentication and authorization architectures involving enterprise identity providers, SSO, SAML 2.0, OAuth 2.0, OpenID Connect (OIDC), and modern federation protocols.\nUnderstand OAuth flows, including Authorization Code with PKCE, Client Credentials, token issuance, access-token validation, refresh tokens, scopes, consent, and token lifecycle management.\nAssess how applications securely obtain, store, use, rotate, and revoke client credentials, access tokens, refresh tokens, certificates, and API keys.\nReview identity federation and cross-account or cross-tenant access, including trust policies, role assumptions, managed identities, and service principals.\nIdentify excessive permissions, overprivileged service accounts, shared identities, insecure trust relationships, hard-coded credentials, and inappropriate privilege escalation paths.\nDesign and recommend least-privilege access models, just-in-time access, strong authentication, privileged access controls, and periodic access reviews.\nEvaluate OAuth-based integrations between enterprise applications, cloud-hosted workloads, and third-party SaaS providers.\n\nCloud Networking Security:\nAssess cloud network architectures, including virtual networks, VPCs, subnets, routing, security groups, network ACLs, firewalls, and network segmentation.\nReview hub-and-spoke architectures, transit connectivity, hybrid-cloud networking, VPNs, dedicated private connections, and inter-cloud connectivity.\nEvaluate private endpoints, private service access, public IP exposure, ingress and egress paths, DNS security, and service-to-service communication.\nReview WAF, API gateway, reverse proxy, load balancer, CDN, and DDoS protection designs.\nUnderstand Zero Trust network architecture and the application of identity-aware access, explicit verification, least privilege, and continuous assessment.\nIdentify network attack paths, exposed management interfaces, unrestricted outbound access, insecure routing, and unintended paths that could bypass approved security gateways.\nRecommend network security controls that align with application architecture, business requirements, and risk exposure.\n\nThird-Party SaaS Security Architecture and Assessments:\nConduct security assessments of third-party SaaS applications before onboarding, integration, significant architectural changes, and production deployment.\nAssess SaaS architecture, authentication, SSO, provisioning, authorization, API integrations, data storage, encryption, tenant isolation, logging, and administrative access.\nEvaluate SaaS integration patterns using OAuth 2.0, OIDC, SAML, SCIM, API keys, certificates, webhooks, and service accounts.\nDetermine whether required controls are supported natively by the SaaS provider or must be enforced through enterprise security services such as the identity provider, CASB/SSPM, SIEM, PAM, or API security gateways.\nAssess external attack surfaces, public endpoints, API exposure, network connectivity, data flows, and dependencies on subcontractors or other service providers.\nReview vendor security documentation, independent assurance reports, penetration-testing evidence, vulnerability management practices, incident response capabilities, and contractual security commitments.\nIdentify gaps between vendor capabilities and enterprise security requirements; recommend remediation, compensating controls, risk acceptance, or rejection where necessary.\nDocument SaaS security assessment results, applicability of controls, ownership, residual risks, and approval recommendations.\n\nThreat Modelling and Risk Assessment:\nConduct threat modelling for cloud infrastructure, application architectures, APIs, mobile applications, AI solutions, and third-party integrations.\nIdentify assets, threat actors, entry points, trust boundaries, data flows, attack surfaces, abuse cases, and potential attack paths.\nApply suitable threat-modelling methodologies such as STRIDE, attack trees, data-flow analysis, and scenario-based risk assessment.\nAnalyse threats associated with misconfiguration, insecure identities, privilege escalation, data exfiltration, exposed services, compromised credentials, and supply-chain compromise.\nEvaluate threats associated with cloud control planes, management APIs, container platforms, serverless services, AI models, agentic workflows, and external tools.\nAssess likelihood, business impact, exploitability, exposure, and potential consequences to determine risk severity.\nRecommend risk-based controls and validate whether residual risk is acceptable.\nMaintain traceability between threats, identified risks, security requirements, remediation actions, and risk acceptance decisions.\n\nZero Trust Architecture and Secure Design Principles:\nApply Zero Trust principles to cloud infrastructure, enterprise applications, APIs, workloads, and data access.\nUnderstand and implement secure design principles, including least privilege, defence in depth, secure defaults, fail-safe behaviour, separation of duties, complete mediation, and minimizing attack surface.\nDesign identity-centric access models that authenticate and authorize users, devices, workloads, and services based on contextual and risk-based requirements.\nApply segmentation, isolation, strong authentication, continuous monitoring, and explicit authorization to reduce lateral movement.\nEnsure that security controls are enforced at appropriate layers rather than relying solely on network perimeter defenses.\nEvaluate architectures for single points of failure, excessive trust, insecure dependencies, inadequate isolation, and weak security boundaries.\nPromote securi...","description_format":"text","description_chars":13029,"description_truncated":true,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Retail & Shop Systems","Custom Software Development"],"lifecycle":[{"event":"open","at":"2026-11-09T05:35:00Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":22,"reasons":["seen:0","win:early","comp:junior"],"computed_at":"2026-11-09T06:03:00Z"},"pay":null,"html_url":"https://alion.io/job/7elevengsc-junior-security-architect","json_url":"https://alion.io/job/7elevengsc-junior-security-architect.json","meta":{"generated_at":"2026-11-09T06:33:50Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":2904,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-10T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1047705},"rest":"https://alion.io/mcp/rest/get_company?id=1047705"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2F7elevengsc-junior-security-architect"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2F7elevengsc-junior-security-architect"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2F7elevengsc-junior-security-architect"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/7elevengsc-junior-security-architect\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2F7elevengsc-junior-security-architect"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3953204}},{"tool":"search_jobs","arguments":{"company":"7-elevengsc.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3953204},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}