Cyber Defense Platform Architect

About ADM:

We are one of the world's largest nutrition companies and a global leader in human and animal nutrition. We unlock the power of nature to provide nourishing quality of life by transforming crops into ingredients and solutions for foods, beverages, supplements, livestock, aquaculture, and pets.

About ADM India Hub:

At ADM, we have long recognized the strength and potential of India's talent pool, which is why we have maintained a presence in the country for more than 25 years. Building on this foundation, we have now established ADM India Hub, our first GCC in India.

At ADM India Hub, we are hiring for IT and finance roles across diverse technology and business functions. We stand at the intersection of global expertise and local excellence, enabling us to drive innovation and support our larger purpose of unlocking the power of nature to enrich quality of life.

Cyber Defense Platform Architect

Key Responsibilities:

• Cyber Defense Platform Strategy & Architecture: Define and maintain the vision, principles, target-state architecture, standards, reference patterns, and roadmap for global cyber defense platforms and enabling technologies.
• Secure by Design: Embed cyber defense requirements, telemetry, logging, integration, access control, recoverability, and operational support needs into solution and platform designs from the earliest architecture and design stages.
• SIEM Modernization: Lead the architecture and modernization of enterprise SIEM capabilities, including scalable ingestion, normalization, enrichment, correlation, retention, search, analytics, and cost-management patterns across hybrid and multi-cloud environments.
• Security Data Visibility Fabric: Establish an architecture that makes security-relevant telemetry discoverable, trustworthy, contextualized, reusable, and accessible across identity, endpoint, network, cloud, application, data, and Operational Technology environments.
• Continuous Operations & Data Flow: Define resilient, continuous, and observable data-flow patterns that provide Cybersecurity Operations with timely access to required telemetry, context, enrichment, and response signals across normal, degraded, and recovery operating conditions.
• Detection Engineering Enablement: Partner with Cyber Defense Operations to provide the telemetry, platform capabilities, integration patterns, test environments, deployment pathways, and architecture needed for effective detection engineering. Cyber Defense Operations retains responsibility for creating, tuning, prioritizing, and operating detection content.
• SOAR & Automation: Design orchestration and automation patterns for alert enrichment, investigation, case management, containment, recovery, and evidence collection while maintaining appropriate human oversight and control.
• Security Operations Platform Enablement: Translate operational requirements from Cyber Defense Operations and Incident Response into resilient platform capabilities that improve visibility, reduce alert fatigue, increase automation, and support measurable improvements in MTTD, MTTR, investigation quality, response consistency, and analyst productivity.
• Cloud Cyber Defense: Design monitoring, analytics, and response capabilities for Microsoft Azure and hybrid environments; ensure cloud-native telemetry and controls are integrated into enterprise cyber defense workflows.
• AI-Enabled Security Operations: Evaluate and responsibly apply AI, machine learning, and generative AI to threat detection, investigation, summarization, prioritization, automation, and decision support, with governance, validation, and human accountability.
• Platform Integration: Define secure and resilient integrations among SIEM, SOAR, XDR, threat intelligence, identity, endpoint, network, vulnerability, cloud, case management, and data platforms through supported APIs and event-driven patterns.
• Resilience & Continuity Assurance: Ensure cyber defense platforms, integrations, automation, and critical data pipelines have documented resilience, availability, backup, recovery, capacity, failover, and continuity requirements that are validated through architecture reviews and testing.
• Metrics & Continuous Improvement: Establish architecture and capability measures for telemetry coverage, detection efficacy, false-positive reduction, automation effectiveness, platform resilience, MTTD, MTTR, and operational adoption.
• Architecture Governance: Lead technical evaluations, architecture reviews, design decisions, exception reviews, and lifecycle planning for cyber defense capabilities and supporting technologies.
• Cross-team Collaboration: Partner with enterprise architects, engineers, analysts, product owners, technology teams, vendors, and business stakeholders to translate operational needs and threat scenarios into sustainable capabilities.
• Documentation & Knowledge Transfer: Develop and maintain capability models, roadmaps, reference architectures, standards, design patterns, decision records, and operational transition documentation.
• Industry Awareness: Maintain knowledge of evolving attacker techniques, security operations practices, cloud technologies, automation, AI, and industry frameworks, and use that knowledge to guide investment and target architectures.
• Operating Model Clarity: Maintain clear alignment between Architecture & Engineering responsibilities and Cyber Defense Operations responsibilities, ensuring platform architecture, engineering, and transition activities are distinct from day-to-day security monitoring and incident execution.

Required Skills & Experience:

• Strong experience designing or modernizing enterprise cyber defense platforms, security monitoring architectures, security analytics environments, or detection and response technology ecosystems.
• Demonstrated architecture or senior engineering experience with SIEM, SOAR, XDR, security analytics, threat intelligence platforms, incident response integrations, and security operations enablement.
• Hands-on knowledge of Microsoft Sentinel, Microsoft Defender XDR, Defender for Cloud, Microsoft Entra ID, Azure Monitor, Log Analytics, and Azure-native integration and automation services.
• Expertise in security telemetry architecture, including source onboarding, parsing, normalization, enrichment, schema design, data quality, retention, tiering, access control, and cost optimization.
• Experience designing highly available and recoverable security platforms and data pipelines, including resilience, continuity, capacity, failover, backup, recovery, monitoring, and operational support requirements.
• Experience enabling detection engineering through scalable telemetry, platform architecture, integration patterns, source control, automated testing, deployment pipelines, and partnership with security operations teams.
• Knowledge of MITRE ATT&CK and its practical use in threat-informed defense, detection mapping, gap analysis, purple-team validation, and operational reporting.
• Experience with automation and integration using APIs, webhooks, event-driven services, infrastructure as code, and scripting languages such as Python or PowerShell.
• Understanding of cloud security architecture and telemetry across Azure; AWS or Google Cloud Platform experience is a plus.
• Knowledge of identity, endpoint, network, email, application, data, vulnerability, and Operational Technology security signals and response dependencies.
• Ability to define and communicate architecture decisions, capability roadmaps, technical standards, risks, tradeoffs, and investment recommendations to technical and non-technical audiences.
• Strong analytical, problem-solving, communication, facilitation, and documentation skills.
• Collaborative mindset with experience working across architecture, engineering, operations, governance, and business teams.

Preferred Requirements:

• 7+ years of experience in Information Technology.
• 5+ years of cybersecurity experience, including experience in security architecture or senior security engineering and direct exposure to Security Operations or Incident Response.
• Experience leading enterprise SIEM, SOAR, XDR, SOC platform modernization, security data lake, security analytics, telemetry fabric, or security automation initiatives.
• Experience with Microsoft Azure architecture and cloud-native security operations at enterprise scale.
• Experience applying AI or machine learning to security analytics, automation, investigation, or operational decision support.
• Experience with product-oriented operating models, platform lifecycle management, licensing, capacity planning, and value measurement.
• Knowledge of cybersecurity architecture and operations frameworks such as NIST Cybersecurity Framework, NIST SP 800-61, MITRE ATT&CK, Zero Trust, and Cybersecurity Mesh Architecture concepts.
• Current security or cloud certifications such as CISSP, CCSP, Microsoft Cybersecurity Architect Expert, Microsoft Azure Solutions Architect Expert, GIAC, or equivalent credentials.
• Project, program, or product management experience supporting complex global technology initiatives.

Leadership Traits:

• Ownership mindset.
• Commitment to helping others thrive.
• Continuous learning.
• Fostering diversity, equity, and inclusion.

Additional Information:

This position offers a complete benefit package, including 401K/ESOP, pension, health, life, and dental insurance. ADM is an equal opportunity employer and makes employment decisions without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, and veteran status.