Security Architect

Project Role : Security Architect

Project Role Description : Define the cloud security framework and architecture, ensuring it meets the business requirements and performance goals. Document the implementation of the cloud security controls and transition to cloud security-managed operations.

Must have skills : Amazon Web Services (AWS) Security

Good to have skills : NA

Minimum 3 Year(s) Of Experience Is Required

Educational Qualification : 15 years full time education

Summary:

We are looking for an AWS IAM Engineer with experience to provide L2/L3 operational support across IAM, SSO, MFA, RBAC, and PAM services. The role requires strong troubleshooting skills, a sound understanding of AWS identity services, and the ability to manage access policies, handle incidents, and deliver clear operational reporting.

Roles & Responsibilities:

Operations and service delivery

• Handle incidents, service requests and change requests across the AWS security service portfolio, meeting agreed response and resolution service levels.
• Triage and action findings, alerts and policy violations, escalating to the client or to vendor support where required.
• Deliver planned changes within approved maintenance windows, including firewall and WAF rule changes, policy updates and configuration amendments.
• Produce daily operational reports and maintain runbooks, standard operating procedures and knowledge articles.
• Participate in problem management, contributing root cause analysis for major incidents within agreed timelines.
  
  

Technical ownership

• Administer AWS WAF rule groups and conditions, tune rules to reduce false positives and false negatives, and manage Firewall Manager security policies.
• Maintain AWS Config rules, including custom rules, organisation and organisational unit rules, and multi-account deployment.
• Operate AWS Security Hub, including central configuration policies, service integrations and findings workflow.
• Manage AWS GuardDuty findings and suppression rules, protection plans, runtime monitoring and cross-account aggregation.
• Administer AWS IAM roles, policies and permission boundaries perform access reviews, credential reporting and key rotation.
• Support AWS KMS and Secrets Manager operations, including key policy, rotation and access control.
• Maintain AWS CloudTrail configuration across accounts, including data events, retention and downstream log integrations.
• Operate AWS Shield Advanced and AWS Certificate Manager, including certificate lifecycle and renewal monitoring.
• Manage Palo Alto VM-Series firewalls deployed on AWS and maintain AWS Security Group rule sets.
  
  

Essential Skills And Experience

• AWS WAF — rule groups, conditions, rule tuning, Firewall Manager security policies.
• AWS Config — managed and custom rules, trigger and evaluation modes, organisation, OU and multi-account rules, configuration history and retention.
• AWS Security Hub — central configuration policies, integration with GuardDuty, Inspector and Macie, findings management.
• AWS GuardDuty — findings analysis, suppression rules, protection plans, cross-region and cross-account aggregation.
• AWS IAM — roles, policies, permission boundaries, Access Analyzer, credential reports, access key and secret key rotation.
• AWS KMS and AWS Secrets Manager — customer managed keys, symmetric and asymmetric encryption, key and secret rotation, access control.
• AWS CloudTrail — multi-account trails, data events, log retention and aggregation.
• AWS Shield Advanced and AWS Certificate Manager.
• AWS Security Groups and network security concepts in a VPC context.
• Working within an ITIL service management framework — incident, change and problem management, ideally on ServiceNow.
• Depth across AWS WAF, Config, Security Hub and IAM is the core requirement. Candidates with particular strength in identity and key management — IAM, federated identity, IAM Identity Center and KMS — should highlight this, as a subset of the positions is weighted that way.
  
  

Professional & Technical Skills:

• Federated identity with AWS — OIDC and SAML identity providers, IAM Identity Center including Active Directory integration.
• Automated remediation using EventBridge and Lambda.
• Infrastructure as code and scripting — Terraform, CloudFormation, Python or Boto3.
• Palo Alto VM-Series and Panorama on public cloud.
• AWS CloudHSM.
• Log and monitoring platforms — CloudWatch, Splunk, Dynatrace.
• Regulated industry experience, particularly life sciences or pharmaceutical, and familiarity with GxP or CIS benchmark controls.
  
  

Additional Information:

• The candidate should have minimum 6 years of experience in AWS Administration.
• This position is based at our Bengaluru office.
• A 15 years full time education is required.