Architect I - Information Security

Identity Security Architect

Function: Security Architecture & Engineering

Reports to: Head of Security Architecture & Engineering

Location: India (Trivandrum, Hyderabad or Bangalore)

Role Overview

UST is seeking an Identity Security Architect to own the enterprise identity security strategy, architecture, and roadmap across its global environment. This is a hybrid role that includes ownership of identity security architecture, implementation, service ownership of IGA and responsible for defining how identity operates as the core security control plane across workforce, non-human, and AI-driven identities in cloud, on-premises, and hybrid contexts.

The role sits within the Security Architecture & Engineering function and is central to advancing UST's Zero Trust posture and identity governance maturity.

In addition to the architecture mandate, this role carries direct service ownership of the enterprise IGA platform -accountable for its operational health, roadmap delivery, vendor relationship, and business outcomes.

Key Responsibilities

1. Identity Strategy & Architecture

1. Own the enterprise identity security architecture spanning IGA, IAM, PAM, and CIAM domains

1. Define and maintain reference architectures, standards, guardrails, and the multi-year identity roadmap

1. Govern and evolve the enterprise identity technology ecosystem - including IGA, IAM, and PAM platforms- ensuring continued alignment to business and security strategy

2. IGA Platform Architecture & Service Ownership

Own and architect the enterprise IGA platform - accountable for platform strategy, roadmap, day-to-day service health, and stakeholder outcomes. Specific responsibilities include:

1. Joiner Mover Leaver lifecycle design and governance

1. Access certification and entitlement governance

1. RBAC/ABAC models and SoD policy enforcement

1. Scalable provisioning and deprovisioning patterns for workforce and service identities

1. Define and track service KPIs and SLAs - provisioning cycle time, certification completion rates, orphaned account ratios

1. Manage the IGA platform vendor relationship, licensing, and renewal lifecycle

1. Own the IGA change and release process in coordination with Security Engineering and IT Operations

1. Act as the escalation point for IGA platform issues, audit findings, and access governance exceptions

3. Non-Human Identity (NHI) Security

1. Define the architecture and controls governing machine identities - service accounts, API keys, workload identities, bots, containers, and serverless functions

1. Establish full lifecycle governance for NHIs: ownership, creation, rotation, and decommissioning

1. Design and enforce secrets management, workload identity federation, and JIT access models for machine identities

4. AI & Agentic Identity Security

1. Define the identity security architecture for AI agents, copilots, and autonomous automation frameworks - including third-party GenAI integrations

1. Establish guardrails for identity attribution, least privilege access, and data access governance for AI pipelines

1. Address emerging risks including:

1. Prompt injection leading to privilege misuse

1. Uncontrolled API key exposure

1. Unauthorized data access by AI systems

5. Integration & Identity Ecosystem Design

1. Architect identity integrations across cloud platforms (Azure, AWS, GCP), directory services (AD, LDAP), and enterprise applications (HRMS, ERP, SaaS)

1. Define federation patterns (SAML, OAuth 2.0, OIDC), API-based provisioning (SCIM), SSO, adaptive authentication, and workload identity

6. Zero Trust & Risk Alignment

1. Embed identity controls into UST's Zero Trust architecture

1. Apply identity-centric threat modelling to address privilege escalation, identity compromise, and lateral movement

1. Ensure alignment with ISO 27001, NIST CSF, GDPR, and applicable client-driven compliance requirements

7. Identity Threat Detection

1. Extend detection coverage across human and non-human identities - anomalous access, service account misuse, and credential abuse

1. Integrate identity signals with EDR/XDR, SIEM, and UEBA platforms

8. Architecture Governance

1. Lead architecture review boards; govern design decisions, standards, and exceptions

1. Maintain architecture documentation, blueprints, and decision records

1. Ensure consistency with enterprise architecture and security engineering standards

9. Stakeholder Collaboration

1. Partner with Security Engineering, Cloud, Application, and Infrastructure teams to ensure identity architecture is embedded in all the deliveries.

1. Provide architectural guidance and oversight across transformation, migration, and platform programs

Required Experience

1. 10+ years in IT/security, with at least 5 years in IAM/IGA architecture at enterprise scale

1. Proven delivery on identity transformation programs - not just advisory

1. Hands-on depth with enterprise IGA platforms

1. Strong working knowledge of Entra ID, Okta, or equivalent IAM platforms

1. Experience securing non-human identities: service accounts, API keys, workload identities, secrets vaults

1. Solid grounding in SAML, OAuth 2.0, OIDC, and SCIM

1. Familiarity with Cloud IAM across AWS, Azure, and GCP

1. Risk and compliance alignment experience -ISO 27001, NIST CSF, GDPR

1. Exposure to AI/ML identity risks is a strong differentiator

What Good Looks Like

The right candidate thinks in architecture, not tickets. They can hold a conversation with a CISO about strategic direction and shift registers with an engineering team about federation patterns. They bring a point of view on NHI and agentic identity - areas where most enterprises are still catching up - and can translate that into executable, governed architecture. On the IGA side, they are comfortable owning a service end to end: platform health, vendor cadence, SLAs, and audit accountability.

Preferred Qualifications

1. Relevant certifications on Enterprise IGA platforms

1. Experience with PAM, Identity Protection and/or identity analytics platforms

1. Exposure to large-scale digital transformation or M&A-driven identity consolidation programs