{"id":3672451,"url":"https://alion.io/job/hcltech-domain-architect-it-security-4","title":"Domain Architect - IT security","company":{"id":225,"name":"HCLTech","domain":"hcltech.com","url":"https://alion.io/company/hcltech","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"SuccessFactors","truth_index":null},"role":"Security","role_family":"Security","seniority":"staff","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Hyderabad, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":14,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Anomaly Detection","optional":false},{"name":"BeyondTrust","optional":false},{"name":"DNP3","optional":false},{"name":"DNS","optional":false},{"name":"IAM","optional":false},{"name":"ISO 27001","optional":false},{"name":"Least Privilege","optional":false},{"name":"MQTT","optional":false},{"name":"OPC UA","optional":false},{"name":"PKI","optional":false},{"name":"SIEM","optional":false},{"name":"VPN","optional":false},{"name":"Zero Trust","optional":false}],"status":"live","first_seen_at":"2026-11-03T09:41:45Z","employer_posted_date":"2026-11-03","last_verified_at":"2026-11-04T08:13:16Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"Job Summary\nOT Architect\nThe OT Security Architect is responsible for defining, governing and assuring secure, resilient and scalable cybersecurity architectures for industrial and Operational Technology environments. The role translates business, engineering, safety, operational and regulatory requirements into practical target architectures, security patterns, technology roadmaps and implementation guardrails.\nThis senior role provides technical leadership across brownfield and greenfield environments, balancing cyber risk reduction with production availability, safety, reliability and maintainability. The architect works across engineering, plant operations, enterprise IT, security operations, vendors and programme teams to establish consistent architecture decisions and enable secure transformation.\nKey Responsibilities\nA. OT Security Architecture and Strategy\nDefine and maintain OT cybersecurity reference architectures, principles, patterns, standards and technology roadmaps.\nAssess current-state architectures and develop pragmatic transition states and target-state designs for industrial environments.\nTranslate business, operational, safety and security requirements into architecture decisions, control requirements and design specifications.\nLead architecture reviews for new plants, production lines, industrial platforms, connected products and major technology changes.\nEnsure architectures support availability, safety, resilience, recovery and maintainability requirements alongside cybersecurity objectives. B. Network Segmentation and Secure Connectivity\nDesign and govern OT/IT segmentation using zones and conduits, industrial DMZs, security zones, trust boundaries and controlled data flows.\nDefine secure connectivity patterns for plant networks, remote sites, cloud or edge services, vendor access and inter-site communications.\nProvide architecture requirements for firewalls, routing, switching, network access control, intrusion detection or prevention, secure gateways and monitoring controls.\nReview firewall and communication matrices to verify business justification, least privilege, traceability and alignment with approved architecture.\nDesign secure remote access patterns for employees, vendors and third parties using identity-aware, monitored and time-bound access controls. C. OT Remote Access Architecture and Security\nDefine and govern the enterprise OT remote access architecture for employees, engineering teams, OEMs, vendors and third-party support personnel.\nArchitect Zero Trust remote access using identity-aware, least-privilege, time-bound and approval-based controls, with session monitoring, recording and auditability where required.\nDefine secure deployment patterns for OT remote access platforms such as Cyolo, Secomea and BeyondTrust, and for secure-access capabilities associated with OT security platforms such as Claroty, according to organizational standards and approved use cases.\nLead architecture and design decisions for Cyolo Secure Remote Access, including resilient platform placement, identity-provider integration, MFA, privileged access, session policies, access workflows, logging and integration with monitoring or incident-response processes.\nEstablish access patterns that minimize direct network exposure, restrict lateral movement and protect critical OT assets without disrupting production availability or vendor-support requirements.\nDefine onboarding, access approval, periodic recertification, emergency access, session review and offboarding requirements for remote users and third parties.\nEvaluate legacy VPN and jump-server arrangements and define risk-based transition roadmaps toward controlled, identity-centric OT remote access.\nProvide architecture assurance for remote access deployments, upgrades and integrations, including availability, capacity, recovery, logging and operational handover requirements. D. Identity, Access and Platform Security\nDefine identity and access architecture for OT users, administrators, service accounts, vendors and non-human identities.\nEstablish requirements for privileged access, multi-factor authentication, role-based access, session oversight and credential protection.\nDefine security architecture requirements for SCADA, DCS, PLC, HMI, historian, engineering workstation, industrial server, edge and IIoT environments.\nGuide secure integration with enterprise services such as identity providers, PKI, DNS, time services, logging, monitoring and security operations platforms.\nSkill Requirements\nE. Risk, Compliance and Security Assurance\nLead OT architecture risk assessments, threat modelling, design reviews and control-gap analyses, and recommend risk-prioritized treatments.\nEmbed IEC 62443 concepts, NIST Cybersecurity Framework practices and applicable organizational or regulatory requirements into architecture deliverables.\nIdentify compensating controls for legacy, unsupported or operationally constrained assets where standard security controls are not feasible.\nDefine security acceptance criteria and provide architecture assurance through design, build, testing, transition and operational handover.\nSupport audit, compliance and customer assurance activities with traceable architecture decisions, control mappings and technical evidence. F. Resilience, Monitoring and Incident Readiness\nDefine architecture requirements for asset visibility, security monitoring, logging, anomaly detection and integration with SOC or incident response processes.\nEnsure architectures address backup, recovery, redundancy, disaster recovery, configuration integrity and operational resilience.\nProvide senior technical guidance during significant OT security incidents, architecture exceptions and complex risk decisions.\nUse lessons learned from incidents, vulnerabilities and operational events to improve architecture standards and control patterns. G. Stakeholder, Vendor and Delivery Leadership\nAct as the senior architecture interface across plant engineering, operations, IT, cybersecurity, safety, risk, compliance and programme leadership.\nChair or contribute to architecture governance forums, design authorities, technical workshops and risk-acceptance discussions.\nEvaluate vendor and product architectures, challenge design assumptions and ensure solutions meet approved security and operational requirements.\nGuide engineering and delivery teams without losing accountability for design intent, architecture traceability and technical quality.\nMentor OT security engineers and architects, promote reusable patterns and strengthen architecture capability across the organization. Technical and Domain Requirements OT/ICS Environments\nDeep understanding of industrial environments and the operational characteristics of SCADA, DCS, PLC, HMI, historian, engineering workstation and industrial server platforms.\nAbility to work within production, safety, lifecycle, availability and change constraints that differ from traditional enterprise IT. Industrial Architecture and Networking\nStrong knowledge of Purdue-aligned architectures, zones and conduits, industrial DMZs, segmentation, network security architecture and controlled OT/IT data exchange.\nKnowledge of industrial and supporting protocols such as Modbus TCP, OPC UA, EtherNet/IP, PROFINET, DNP3, IEC 60870-5-104, MQTT and vendor-specific protocols. Security Technologies\nArchitecture-level knowledge of industrial firewalls, IDS/IPS, NAC, OT secure remote access, PAM, IAM, MFA, PKI, endpoint controls, asset visibility, vulnerability management, SIEM and security monitoring.\nHands-on architecture or design experience with Cyolo Secure Remote Access is strongly preferred; exposure to comparable OT remote access solutions such as Secomea, BeyondTrust and Claroty secure-access capabilities is advantageous.\nExperience integrating security controls with legacy industrial systems, enterprise services, edge platforms and approved cloud services. Architecture Methods and Governance\nProven ability to produce architecture principles, patterns, standards, roadmaps, design decisions, threat models and risk-based recommendations.\nExperience governing designs through architecture review boards, technical assurance gates, exceptions and implementation oversight. Standards and Risk\nStrong working knowledge of IEC 62443 and NIST guidance for industrial control systems; familiarity with ISO 27001 and sector-specific requirements is advantageous\nOther Requirements\nAbility to interpret control objectives and apply them proportionately to industrial risks, operational constraints and business priorities.\nExperience and Qualification Profile\nMinimum 14 years of overall experience in cybersecurity, industrial automation, network security or infrastructure, including substantial experience in OT/ICS environments.\nDemonstrated experience leading OT security architecture for complex, multi-site, brownfield or greenfield industrial programmes.\nProven experience developing security architectures, segmentation models, risk assessments, standards, roadmaps and design-assurance outputs.\nExperience engaging plant operations, engineering, enterprise IT, security, risk, vendors and senior stakeholders across the solution lifecycle.\nBachelor’s degree in engineering, Computer Science, Cybersecurity, Information Technology or a related discipline; a relevant master’s degree is advantageous.\nPreferred certifications include IEC 62443 Cybersecurity Expert or equivalent, GICSP, CISSP, CISM, SABSA, TOGAF or other relevant architecture and industrial cybersecurity credentials.\nExperience designing and governing remote access for industrial environments, including Cyolo Secure Remote Access and integration with identity, MFA, privileged-access, monitoring and governance processes.","description_format":"text","description_chars":9805,"description_truncated":false,"requirements":{"experience_years_min":14,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":true},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Professional Services","Science & Engineering","Information Security"],"lifecycle":[{"event":"open","at":"2026-11-03T09:41:45Z"}],"visa":[],"liveness":{"score":99,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.993,"p_room":1,"age_days":0,"expected_fill_days":32,"reasons":["conf:3","wave","velocity","win:early","comp:brand"],"computed_at":"2026-11-04T06:34:25Z"},"pay":null,"html_url":"https://alion.io/job/hcltech-domain-architect-it-security-4","json_url":"https://alion.io/job/hcltech-domain-architect-it-security-4.json","meta":{"generated_at":"2026-11-04T08:38:41Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":13434,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-05T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":225},"rest":"https://alion.io/mcp/rest/get_company?id=225"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fhcltech-domain-architect-it-security-4"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fhcltech-domain-architect-it-security-4"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fhcltech-domain-architect-it-security-4"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/hcltech-domain-architect-it-security-4\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fhcltech-domain-architect-it-security-4"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3672451}},{"tool":"search_jobs","arguments":{"company":"hcltech.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3672451},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}