Junior Security Architect

Job Description: Security Architect
Role overview:
The Security Architect is responsible for assessing, designing, reviewing, and governing security architectures across
cloud infrastructure, enterprise applications, mobile applications, APIs, third-party SaaS platforms, and AI-enabled
applications. The role ensures that security requirements are incorporated into solution architecture and design from
the early stages of the development lifecycle through deployment and operations.
The architect will identify security risks, recommend risk-based controls, define reusable security patterns and
reference architectures, and work with engineering and operations teams to ensure that solutions align with
enterprise security policies, standards, and regulatory obligations.
1. Key Responsibilities
A. Security Architecture Reviews and Solution Design
• Conduct security architecture and design reviews for new applications, existing applications, technology
transformations, cloud migrations, and major architectural changes.
• Assess architectures for web applications, mobile applications (Android and iOS), APIs, microservices,
event-driven systems, serverless applications, containerized applications, and distributed systems.
• Review solution architecture diagrams, data-flow diagrams, trust boundaries, network flows, authentication
mechanisms, authorization models, and technology dependencies.
• Identify security gaps, architectural weaknesses, attack surfaces, misconfigurations, and design-level risks.
• Define security requirements and recommend appropriate preventive, detective, and corrective controls.
• Evaluate solutions against enterprise security policies, technical standards, reference architectures, and
security baselines.
• Document findings, risk ratings, remediation recommendations, compensating controls, and residual risks.
• Collaborate with solution architects, application teams, infrastructure teams, and business stakeholders to
integrate security into solution design.
B. Cloud Security Architecture
• Perform security architecture reviews across AWS, Microsoft Azure, Google Cloud Platform (GCP), Oracle
Cloud Infrastructure (OCI), and hybrid or on-premises environments.
• Demonstrate a strong understanding of cloud service models, shared responsibility models, cloud-native
services, landing zones, subscriptions/accounts, organizational hierarchies, and multi-account or multi
subscription architectures.
• Assess the security of IaaS, PaaS, cloud-native services, managed databases, storage services, serverless
workloads, containers, Kubernetes, and platform services.
• Design secure cloud architectures incorporating network segmentation, private connectivity, secure
service-to-service communication, encryption, identity controls, centralized logging, and monitoring.
• Evaluate cloud configurations for excessive permissions, public exposure, insecure management
interfaces, insecure service configurations, and unintended trust relationships.
• Assess the security implications of hybrid-cloud connectivity, cross-account access, cross-subscription
communication, third-party integrations, and multi-cloud deployments.
• Define and promote reusable cloud security patterns, approved architectural designs, and secure
deployment blueprints.
C. Application, API and Mobile Application Security
• Conduct security reviews for web applications, mobile applications, APIs, microservices, backend services,
and enterprise application integrations.
• Understand common application security vulnerabilities, including injection, broken access control,
authentication weaknesses, insecure session management, insecure data handling, and security
misconfiguration.
• Review application authentication and authorization flows, token handling, session lifecycle, API exposure,
and service-to-service communication.
• Assess mobile application security risks, including insecure local storage, sensitive data leakage, certificate
validation weaknesses, reverse engineering, insecure backend APIs, and compromised-device scenarios.
• Evaluate API gateway architectures, web application firewalls (WAFs), rate limiting, input validation, API
authentication, authorization, and abuse prevention.
• Review security implications of application frameworks, third-party libraries, open-source components,
software supply chains, and external integrations.
• Translate application security findings from penetration testing, SAST, DAST, SCA, and API security testing
into actionable architecture improvements.
• Apply secure software development lifecycle (SSDLC) principles and integrate security requirements into
design, development, testing, and deployment.
D. AI Application and Emerging Technology Security
• Conduct security architecture reviews for AI-powered applications, large language model (LLM) solutions,
retrieval-augmented generation (RAG), AI agents, and enterprise AI integrations.
• Evaluate AI application architectures involving model providers, AI platforms, embedding services, vector
databases, data pipelines, orchestration frameworks, and external tools.
• Assess risks such as prompt injection, sensitive information disclosure, insecure output handling, excessive
agency, insecure tool execution, and improper trust in model outputs.
• Review AI agent and Model Context Protocol (MCP) architectures, including tool permissions,
authentication, authorization, input and output validation, and execution boundaries.
• Assess security controls for model access, AI gateways, API endpoints, model registries, prompts,
embeddings, vector stores, and AI-related data flows.
• Evaluate AI integration patterns involving enterprise identity providers, OAuth 2.0, OpenID Connect (OIDC),
API keys, managed identities, and workload identities.
• Define security requirements for AI application onboarding, approved AI services, third-party AI tools, AI
governance, and production deployment.
• Apply relevant AI security frameworks and guidance, including the NIST AI Risk Management Framework and
OWASP guidance for LLM applications.
E. Identity and Access Management (IAM), OAuth and API Security
• Demonstrate strong knowledge of cloud IAM concepts, identity federation, role-based access control
(RBAC), attribute-based access control (ABAC), privileged access management (PAM), and workload
identities.
• Understand the critical role of IAM in cloud security and its impact on the security of applications,
infrastructure, APIs, data, and administrative operations.
• Review authentication and authorization architectures involving enterprise identity providers, SSO, SAML
2.0, OAuth 2.0, OpenID Connect (OIDC), and modern federation protocols.
• Understand OAuth flows, including Authorization Code with PKCE, Client Credentials, token issuance,
access-token validation, refresh tokens, scopes, consent, and token lifecycle management.
• Assess how applications securely obtain, store, use, rotate, and revoke client credentials, access tokens,
refresh tokens, certificates, and API keys.
• Review identity federation and cross-account or cross-tenant access, including trust policies, role
assumptions, managed identities, and service principals.
• Identify excessive permissions, overprivileged service accounts, shared identities, insecure trust
relationships, hard-coded credentials, and inappropriate privilege escalation paths.
• Design and recommend least-privilege access models, just-in-time access, strong authentication,
privileged access controls, and periodic access reviews.
• Evaluate OAuth-based integrations between enterprise applications, cloud-hosted workloads, and third
party SaaS providers.
F. Cloud Networking Security
• Assess cloud network architectures, including virtual networks, VPCs, subnets, routing, security groups,
network ACLs, firewalls, and network segmentation.
• Review hub-and-spoke architectures, transit connectivity, hybrid-cloud networking, VPNs, dedicated
private connections, and inter-cloud connectivity.
• Evaluate private endpoints, private service access, public IP exposure, ingress and egress paths, DNS
security, and service-to-service communication.
• Review WAF, API gateway, reverse proxy, load balancer, CDN, and DDoS protection designs.
• Understand Zero Trust network architecture and the application of identity-aware access, explicit
verification, least privilege, and continuous assessment.
• Identify network attack paths, exposed management interfaces, unrestricted outbound access, insecure
routing, and unintended paths that could bypass approved security gateways.
• Recommend network security controls that align with application architecture, business requirements, and
risk exposure.
G. Third-Party SaaS Security Architecture and Assessments
• Conduct security assessments of third-party SaaS applications before onboarding, integration, significant
architectural changes, and production deployment.
• Assess SaaS architecture, authentication, SSO, provisioning, authorization, API integrations, data storage,
encryption, tenant isolation, logging, and administrative access.
• Evaluate SaaS integration patterns using OAuth 2.0, OIDC, SAML, SCIM, API keys, certificates, webhooks,
and service accounts.
• Determine whether required controls are supported natively by the SaaS provider or must be enforced
through enterprise security services such as the identity provider, CASB/SSPM, SIEM, PAM, or API security
gateways.
• Assess external attack surfaces, public endpoints, API exposure, network connectivity, data flows, and
dependencies on subcontractors or other service providers.
• Review vendor security documentation, independent assurance reports, penetration-testing evidence,
vulnerability management practices, incident response capabilities, and contractual security
commitments.
• Identify gaps between vendor capabilities and enterprise security requirements; recommend remediation,
compensating controls, risk acceptance, or rejection where necessary.
• Document SaaS security assessment results, applicability of controls, ownership, residual risks, and
approval recommendations.
H. Threat Modelling and Risk Assessment
• Conduct threat modelling for cloud infrastructure, application architectures, APIs, mobile applications, AI
solutions, and third-party integrations.
• Identify assets, threat actors, entry points, trust boundaries, data flows, attack surfaces, abuse cases, and
potential attack paths.
• Apply suitable threat-modelling methodologies such as STRIDE, attack trees, data-flow analysis, and
scenario-based risk assessment.
• Analyse threats associated with misconfiguration, insecure identities, privilege escalation, data exfiltration,
exposed services, compromised credentials, and supply-chain compromise.
• Evaluate threats associated with cloud control planes, management APIs, container platforms, serverless
services, AI models, agentic workflows, and external tools.
• Assess likelihood, business impact, exploitability, exposure, and potential consequences to determine risk
severity.
• Recommend risk-based controls and validate whether residual risk is acceptable.
• Maintain traceability between threats, identified risks, security requirements, remediation actions, and risk
acceptance decisions.
I. Zero Trust Architecture and Secure Design Principles
• Apply Zero Trust principles to cloud infrastructure, enterprise applications, APIs, workloads, and data
access.
• Understand and implement secure design principles, including least privilege, defence in depth, secure
defaults, fail-safe behaviour, separation of duties, complete mediation, and minimizing attack surface.
• Design identity-centric access models that authenticate and authorize users, devices, workloads, and
services based on contextual and risk-based requirements.
• Apply segmentation, isolation, strong authentication, continuous monitoring, and explicit authorization to
reduce lateral movement.
• Ensure that security controls are enforced at appropriate layers rather than relying solely on network
perimeter defenses.
• Evaluate architectures for single points of failure, excessive trust, insecure dependencies, inadequate
isolation, and weak security boundaries.
• Promote security-by-design and privacy-by-design throughout the solution lifecycle.
J. Cloud Security Governance, Policies and Standards
• Develop, maintain, and implement enterprise cloud security policies, standards, technical baselines,
reference architectures, and security patterns.
• Translate enterprise security policies into actionable technical requirements for cloud platforms,
applications, data, IAM, networking, and operations.
• Establish and maintain security architecture review processes, approval criteria, security exceptions, risk
acceptance workflows, and remediation tracking.
• Define control ownership and accountability across Security Architecture, Cloud Engineering, Application
Engineering, IAM, DevOps, SOC, and business teams.
• Establish cloud security governance requirements for new services, cloud adoption, account or
subscription onboarding, application deployment, and technology changes.
• Assess cloud security posture against defined baselines and applicable regulatory, contractual, and
organizational requirements.
• Establish mechanisms for monitoring control implementation, measuring compliance, reporting risk, and
tracking remediation.
• Promote security automation and policy-as-code to improve consistency, reduce manual effort, and
prevent noncompliant deployments.
K. Cloud Platform and Infrastructure Security
• Review security controls for virtual machines, operating systems, containers, Kubernetes clusters,
serverless functions, managed databases, storage, and cloud platform services.
• Assess infrastructure provisioning practices and recommend controlled deployment through Infrastructure
as Code (IaC), approved templates, and governed CI/CD pipelines.
• Review Terraform, CloudFormation, and other infrastructure automation for insecure configurations,
excessive permissions, exposed resources, and policy violations.
• Assess secrets management, certificate management, encryption, configuration hardening, patch
management, vulnerability remediation, and workload isolation.
• Evaluate container image security, cluster access controls, workload identities, admission controls,
runtime security, and Kubernetes network policies.
• Review cloud security posture management (CSPM), cloud-native application protection platforms
(CNAPP), cloud detection and response (CDR), and workload protection capabilities.
• Identify opportunities to embed security controls into cloud engineering workflows and automated
deployment pipelines.
L. Cloud Security Operations and Monitoring
• Understand how architectural decisions affect security monitoring, incident detection, investigation,
containment, and recovery.

• Define logging, auditability, telemetry, and ing requirements for cloud control planes, applications,
identities, APIs, and workloads.
• Ensure security-relevant logs are integrated with enterprise SIEM and monitoring platforms and are retained
according to organizational requirements.
• Review cloud detection and response use cases, threat detection coverage, escalation processes, and
incident response requirements.
• Work with SOC and Cloud Security Operations teams to address visibility gaps, detection limitations, false
positives, and recurring security incidents.
• Assess whether critical workloads, identities, data stores, and exposed services have appropriate
monitoring and response coverage.
• Recommend preventive and detective controls that reduce risk while supporting operational resilience and
business continuity.
• Support security incident investigations by analyzing architectural weaknesses, attack paths, and
opportunities for control improvements.
M. Cloud Data Security and Privacy
• Assess data classification, ownership, storage, processing, transfer, sharing, retention, and deletion
requirements.
• Review encryption at rest and in transit, key management, secrets management, tokenization, masking, and
access controls.
• Evaluate security of cloud storage, databases, data lakes, analytics platforms, backups, snapshots, and
disaster recovery environments.
• Assess data exposure risks arising from public access, cross-account sharing, excessive permissions,
insecure APIs, and third-party integrations.
• Define controls for sensitive data discovery, access monitoring, exfiltration prevention, and secure data
lifecycle management.
• Review data residency, privacy, retention, and cross-border transfer requirements where applicable.
• For AI solutions, assess risks involving training data, prompts, embeddings, vector databases, retrieval
pipelines, model outputs, and sensitive information leakage.
N. Security Controls Planning and Implementation
• Convert architecture review findings and threat assessments into clearly defined, prioritized, and
measurable security controls.
• Develop control implementation plans covering control objectives, technical requirements, ownership,
dependencies, implementation timelines, and validation criteria.
• Work with engineering teams to select and implement appropriate controls using native cloud capabilities
and enterprise security tooling.
• Define preventive, detective, corrective, and compensating controls based on business risk and technical
feasibility.
• Validate control effectiveness through design reviews, configuration assessments, evidence collection,
testing, and operational feedback.
6
• Track remediation actions, exceptions, residual risks, and overdue security findings.
• Ensure that controls are operationally sustainable and integrated into established engineering and security
operations processes.
O. Reference Architectures and Security Patterns
• Develop and maintain reusable security reference architectures for cloud platforms, enterprise
applications, APIs, mobile applications, AI applications, and SaaS integrations.
• Create architecture patterns for IAM, OAuth-based integrations, Zero Trust, network segmentation, secure
data access, secrets management, logging, and threat detection.
• Define approved architectural patterns for RAG applications, AI gateways, AI agents, MCP servers, and
model integrations where applicable.
• Establish architecture decision records, security design guidance, reusable diagrams, control mappings,
and implementation examples.
• Ensure reference architectures remain aligned with evolving threats, cloud-native capabilities, enterprise
standards, and business requirements.
• Enable engineering teams to adopt secure-by-default designs and accelerate security reviews through
standardized patterns.
2. Required Technical Knowledge and Skills
The candidate should demonstrate practical understanding and the ability to apply the following concepts during
architecture reviews.
Technical domain
Required knowledge
Cloud platforms
AWS, Azure, GCP, OCI, IaaS, PaaS, cloud-native services, shared responsibility
Application security
Web, microservices, APIs, authentication, authorization, secure SDLC
Identity and access
IAM, RBAC, ABAC, federation, SSO, PAM, workload identities
OAuth and API
security
OAuth 2.0, OIDC, SAML, JWT, PKCE, scopes, token validation, API gateways
Cloud networking
VPC/VNet, segmentation, private endpoints, firewalls, WAF, DNS, hybrid connectivity
Threat modelling
STRIDE, attack trees, trust boundaries, data-flow diagrams, risk assessment
Zero Trust
Identity-centric access, explicit verification, least privilege, continuous assessment
Cloud infrastructure
IaC, Terraform, CloudFormation, containers, Kubernetes, serverless
SaaS security
Vendor assessments, SSO, SCIM, OAuth integrations, tenant isolation, external attack
surface
Cloud data security
Security operations
Encryption, KMS, secrets, classification, access control, data protection
SIEM, CSPM, CNAPP, CDR, vulnerability management, incident response
AI security
LLMs, RAG, AI agents, MCP, prompt injection, model and data security
Security governance
Policies, standards, baselines, reference architectures, risk exceptions, control
assurance

3. Frameworks and Industry Standards
The candidate should have familiarity with relevant industry frameworks and security standards, including:
• NIST Cybersecurity Framework (CSF).
• NIST SP 800-53 and NIST SP 800-207 (Zero Trust Architecture).
• Cloud Security Alliance Cloud Controls Matrix (CSA CCM).
• CIS Benchmarks and cloud provider security best practices.
• OWASP Top 10, OWASP API Security Top 10, and OWASP MASVS/MSTG for mobile applications.
• OWASP SAMM and secure software development practices.
• NIST AI Risk Management Framework and OWASP guidance for LLM application security.
• ISO/IEC 27001 and ISO/IEC 27017, where applicable.
• MITRE ATT&CK and relevant cloud threat-modeling resources.
• OAuth 2.0 and OpenID Connect specifications.
The candidate is not expected to be an expert in every framework. They should be able to select appropriate
requirements, map security controls, and apply the relevant guidance to actual architecture decisions.
4. Required Experience and Qualifications
• Bachelor's or master's degree in Computer Science, Information Technology, Cybersecurity, or a related
discipline.
• Typically, 8–12+ years of experience in cybersecurity, with substantial experience in security architecture,
cloud security, application security, or infrastructure security.
• Demonstrated experience conducting security architecture reviews for enterprise-scale applications and
cloud solutions.
• Hands-on experience assessing cloud security configurations, IAM, networking, application integrations,
and security controls.
• Experience working with engineering teams to remediate architectural risks and implement security
controls.
• Experience preparing architecture review reports, threat models, security recommendations, reference
architectures, and governance documentation.
• Ability to communicate complex technical risks to both engineering teams and senior stakeholders.
• Experience with multi-cloud environments, enterprise SaaS security, and AI application security is highly
desirable.
Preferred certifications:
• CISSP/ CCSP/ISSAP/ SABSA/ equivalent enterprise/security architecture certification
• AWS Security Specialty, Microsoft Azure Security Engineer, or equivalent cloud security certification
• Relevant AI security certifications

5. Key Competencies
The successful candidate should demonstrate the following competencies:
1. Architecture assessment: Ability to understand a proposed solution and identify security risks across its
components and trust boundaries.
2. Security design: Ability to recommend appropriate architectures and controls, rather than simply identify
vulnerabilities.
3. Risk-based decision-making: Ability to prioritize findings based on likelihood, impact, exposure, and
business context.
4. Technical depth: Ability to explain authentication flows, cloud networking, IAM policies, token lifecycles,
data flows, and control implementation.
5. Cross-functional collaboration: Ability to work with architects, developers, cloud engineers, operations
teams, IAM, SOC, and third-party vendors.
6. Governance and documentation: Ability to develop actionable standards, review reports, reusable patterns,
and remediation plans.
7. Communication: Ability to explain technical risks and present practical recommendations to technical
teams and management.
6. Expected Deliverables
The Security Architect is expected to produce and maintain:
• Security Architecture Review reports and recommendations.
• Threat models, data-flow diagrams, and attack-surface assessments.
• Cloud, application, mobile, API, AI, and SaaS security assessment reports.
• Security requirements and control implementation plans.
• Security reference architectures, reusable patterns, and secure design guidelines.
• Architecture risk registers, remediation trackers, and risk exception documentation.
• Security architecture standards, technical baselines, and control mappings.
• Security design validation and control effectiveness evidence.