Senior Manager Information Security
Job Location:
Monthly Salary:
Posted:
Application Deadline:
Vacancies:
Job Summary
FunctionInformation Security Architecture & Engineering
Reports toCISO
LocationBengaluru India (hybrid) global remit across US India Colombia Philippines
TeamSecurity architects and domain specialists (application infrastructure cloud)
Modern enterprises do not get breached in the application or in the infrastructure they get breached in the space between them. APIs data pipelines service handoffs and integration layers form a seam that traditionally has no single owner: application security regimes stop at the code boundary infrastructure security regimes stop at the host and network boundary and the integration fabric between them is under-governed by both.
The Security Architect owns end-to-end security architecture across the enterprise application security infrastructure security and explicitly the integration seam between them. The mandate is to design standardise and defend the security architecture of a hybrid multi-cloud high-volume data environment operating across four geographies and a 30000 workforce handling regulated healthcare data.
This is a security architecture role not a GRC role. The incumbent is a practising technologist who designs and reviews systems at the whiteboard and in the design document not an audit compliance or risk-register manager. Candidates whose background is predominantly GRC audit coordination or compliance programme management will not be considered for this position regardless of seniority. Familiarity with regulatory context (HIPAA HITRUST SOC 2) is expected as environmental literacy it is not the job.
1. Enterprise Security Architecture Ownership
- Define and maintain the target-state security architecture reference architectures and reusable secure design patterns across on-premise hybrid and multi-cloud estates.
- Chair the security design review board; every significant platform product and integration passes through architecture review with documented control decisions.
- Set hardening and configuration baselines at the operating system level (Windows and Linux) and defend them against engineering pushback with technical argument not policy citation.
2. Application Security Architecture
- Own secure-by-design standards across the SDLC: threat modelling secure design review cryptographic standards secrets management and AppSec tooling architecture (SAST DAST SCA secrets scanning).
- Define API security architecture end to end: authentication and authorisation models (OAuth 2.0 OIDC mTLS service-to-service trust) gateway patterns schema and payload validation rate limiting and abuse detection.
3. Infrastructure Security Architecture
- Architect network segmentation zero-trust access identity and privileged-access architecture and endpoint security integration across data centres and cloud.
- Own workload security architecture in a multi-cloud environment: landing zones container and Kubernetes security infrastructure-as-code review and cloud-native control selection (CSPM DSPM CNAPP alignment).
4. The Integration Seam Explicit Mandate
- Own security architecture for the layer where application and infrastructure regimes meet: API gateways and service meshes middleware and message queues data ingestion and ETL/ELT pipelines file-transfer and B2B handoffs and third-party integrations.
- For every material data flow establish explicit control ownership at each hop ingestion staging transformation serving consumption so that no handoff is unowned and no control assumption is implicit.
- Design trust boundaries and data-in-motion protections across environment transitions (on-prem to cloud cloud to cloud enterprise to partner).
5. Leadership and Advisory
- Lead and grow a team of security architects; raise the architectural bar across engineering and platform teams through patterns enablement and review not gatekeeping.
- Serve as principal technical advisor to the CIO and CISO on architecture-driven risk decisions vendor and platform architecture evaluations and security investment trade-offs.
- Partner with SOC and detection engineering so that architecture decisions produce observable defensible telemetry architecture that cannot be monitored is architecture that cannot be defended.
The successful candidate can do all of the following unaided at a whiteboard:
- Operating systems. Explain process memory privilege and credential models on Windows and Linux and derive hardening decisions from them rather than from checklists.
- Data flow architecture. Draw a typical enterprise data path ingestion landing/staging ETL/ELT transformation warehouse/lake serving API and reporting consumption and place the correct control (and control owner) at every hop and handoff.
- API mechanics. Articulate how APIs actually work: token issuance and validation gateway versus service-level enforcement east-west versus north-south traffic schema validation and common failure modes (BOLA/IDOR token replay over-permissive scopes).
- Hybrid and multi-cloud. Deep working fluency in at least two of AWS Azure and GCP including identity federation network architecture encryption and key management and the security consequences of managed-service choices.
- Identity and network. Zero-trust architecture segmentation strategy IAM/PAM design and directory/federation architecture across a heterogeneous estate.
- Modern platforms. Containers and Kubernetes service mesh CI/CD pipeline security and infrastructure-as-code review.
Certifications Required
- At least one current technically-oriented security architecture or engineering certification: CISSP (ISSAP concentration strongly preferred) SABSA (SCF/SCP) CCSP or GIAC GDSA/GCSA.
- Offensive or hands-on credentials (OSCP GPEN GWAPT) are a strong plus they evidence the attacker-informed mindset this role demands.
- GRC-track certifications (CISA CRISC ISO 27001 Lead Auditor/Implementer) do not qualify on their own and will not be weighted as substitutes for the above.
Experience
- 15 years in information security with 5 years in a security architecture leadership role covering both application and infrastructure domains not one or the other.
- Demonstrable ownership of security architecture in a hybrid multi-cloud environment at enterprise scale.
- Experience in regulated-data environments (healthcare financial services or equivalent) preferred; global or multi-geography operating experience preferred.
Shortlisted candidates should expect a whiteboard-first evaluation including:
- Drawing an end-to-end data flow (ingestion through ETL/ELT to API-served consumption) and defending the placement and ownership of every security control at every handoff.
- Walking a realistic breach path that crosses the application/infrastructure seam for example a compromised integration credential moving laterally through a pipeline and explaining where architecture should have stopped it.
- Defending a reference architecture under sustained technical challenge from senior engineers.
Candidates who answer architecture questions with governance frameworks will not advance.
Required Experience:
Senior Manager
About Company
With world's largest medical coding staff, Omega Healthcare specializes in medical coding, revenue cycle management to improve revenue.
