• Develops security reference architectures, design patterns, and technical standards for cloud-native applications.

• Leads application security initiatives including SAST, DAST, software composition analysis (SCA), Infrastructure as Code (IaC) scanning, container security, and API security.

• Works directly with the enterprise architect to ensure that overall enterprise security architecture, governance, and guidance is being executed on all IT domain levels.

• Evaluates cloud services and third-party technologies for security risks and compliance requirements.

• Collaborates with security operations, infrastructure, compliance, and engineering teams to investigate and resolve security findings.

• Acts as a trusted advisor to development, infrastructure, network, cloud, data, and security teams.

• Ensures cloud applications comply with organizational policies and applicable regulatory frameworks such as PCI DSS, HIPAA, SOC 2, ISO 27001, NIST, and GDPR.

• Provides technical leadership and mentorship to development teams on secure coding practices and cloud security.

• Performs other duties as assigned by management.

Qualifications

KNOWLEDGE/SKILLS/ABILITIES (KSAs):

• Bachelor’s degree in computer science, business, or a related field required (or equivalent work experience).

• 7+ years of experience securing enterprise environments across on-premises, hybrid, and cloud infrastructures.

• Strong understanding of secure software development lifecycle (SSDLC) and DevSecOps practices.

• Strong knowledge of secure coding principles and common application vulnerabilities (OWASP Top 10, API Security Top 10).

• Solid knowledge and experience working with Azure Dev Ops technology with focus on CI/CD pipelines and GIT repositories.

• Strong knowledge of identity and access management, authentication, authorization, OAuth, OpenID Connect, SAML, risk management, and Zero Trust principles.

• Strong familiarity with SIEM, EDR/XDR, IAM, PAM, CASB, DLP, and vulnerability management platforms.

• Experience in healthcare is preferred.

• CISSP certification is preferred.

• Ability to understand and translate business needs, aligning them to proper technical application solutions.

• Ability to translate security policy, regulatory requirements, and risk findings into practical architecture guidance.

• Excellent communication and collaboration skills with the ability to work with multiple teams simultaneously.

• Excellent time management skills and ability to work on multiple business critical projects simultaneously.

• Understanding of core security and compliance principles in a healthcare environment.

• Strong analytical and problem-solving skills with the ability to solve complex technical problems.

Originally posted on Himalayas