1. Enterprise Security Architecture Strategy

- Define an end-to-end, layered (Defense-in-depth) cybersecurity architecture across cloud, SIEM/SOC, MDR, CTEM,CRV,SNA, IAM, network, endpoint, and data domains
- Establish reference architectures, design patterns, and reusable security blueprints that delivery teams can adopt rather than rebuild
- Map capabilities to business risk, maintain a forward-looking architecture roadmap, and rationalize tooling to reduce complexity and tool sprawl

2. Threat Modeling Threat-Informed Defense

- Establish enterprise threat modeling practices (e.g. STRIDE, attack trees, MITRE ATTCK) and embed them early in the design lifecycle (security-by-design)
- Identify trust boundaries, attack paths, and data flows; translate identified threats into prioritized, actionable controls
- Extend threat modeling to AI/LLM and automation systems, addressing risks such as prompt injection, model abuse, and data poisoning

3. Zero Trust Architecture

- Define and drive the Zero Trust strategy and roadmap across identity, devices, network, applications, and data
- Apply least-privilege access, micro-segmentation, strong authentication/MFA, conditional access, and continuous verification
- Treat identity as the primary control plane, aligning Zero Trust closely with IAM and Secure Network Access

4. Identity Access Management (IAM)

- Architect IAM using Microsoft Entra - authentication and authorization, RBAC/ABAC, conditional access, and the identity lifecycle (joiner / mover / leaver)
- Design privileged access management (PAM/PIM), access governance and reviews, and protection of workload and non-human identities
- Ensure IAM underpins Zero Trust as the enterprises primary security perimeter

5. Detection, MDR SOC Modernization

- Architect a proactive, predictive, and increasingly autonomous Security Operations Center (SOC), including a defined detection engineering lifecycle (detection-as-code, ATTCK coverage mapping, tuning to reduce false positives) and threat hunting
- Integrate Managed Detection and Response (MDR) - align 24/7 detection and response,



define the shared-responsibility model, and connect MDR telemetry and response actions into the internal SIEM/SOAR
- Drive measurable improvements in mean time to detect and respond (MTTD/MTTR)

6. Continuous Threat Exposure Management (CTEM)

- Establish a CTEM program across the five stages - scoping, discovery, prioritization, validation, and mobilization
- Prioritize exposures by real exploitability and business impact (beyond raw CVE counts), incorporating breach-and-attack simulation and attack-path analysis
- Drive continuous, evidence-based exposure reduction and remediation

7. Secure Network Access

- Architect Secure Network Access using Zero Trust Network Access (ZTNA) and SASE/SSE principles, replacing legacy flat-network and VPN models
- Design network segmentation / micro-segmentation and east-west visibility, integrating Network Detection and Response (NDR)
- Secure hybrid, remote, and third-party access for users and workloads

8. Cyber Resilience Recovery (Cyber Recovery Vault)

- Design cyber resilience and recovery architecture, including an isolated, immutable Cyber Recovery Vault (air-gapped) and clean-room recovery capability
- Architect recovery from ransomware and destructive attacks, integrate with backup/DR, and define recovery objectives (RPO/RTO) and data-integrity validation
- Establish regular recovery testing and align the design with operational resilience requirements

9. AI GenAI-Enabled Security

- Design AI-driven detection and response; implement Security Copilot and agentic systems for automated triage, investigation, and analyst augmentation, progressing toward an autonomous SOC




- Apply Generative AI responsibly - establish governance and guardrails for GenAI risks (prompt injection, data leakage, hallucination, model and data security), with human-in-the-loop for high-impact actions
- Enable adaptive and self-healing security systems

10. AI-Enabled Automation Platform Engineering

- Drive an automation-first approach - SOAR playbooks, agentic and AI-enabled automation, and self-healing workflows, targeting 3050% automation enablement
- Architect platforms using Microsoft Sentinel, Defender, Entra, and Purview; build reusable modules for detection, response, and automation
- Apply engineering practices including infrastructure-as-code, detection-as-code, version control, and testing

11. Innovation Leadership

- Partner with Solutions Development to lead PoCs and emerging-technology adoption; translate current technology into scalable solutions
- Work with Delivery to understand real-world issues, ideate, and create reusable assets

12. Governance Compliance

- Align architecture with ISO 27001 and NIST (CSF / 800-53) standards, and embed security-by-design and compliance-as-code
- Support audits and evidence collection; balance compliance requirements with risk-based exposure reduction

13. Collaboration Stakeholder Influence

- Work closely with delivery, engineering, and business teams
- Act as a trusted technical advisor across the organization
- #LI-SK2

- Bachelors or Masters degree in a relevant field
- 1218 years of cybersecurity experience, including hands-on architecture and engineering
- Deep expertise in the Microsoft Security stack (Sentinel, Defender, Entra, Purview) and cloud security
- Demonstrated experience across Zero Trust, IAM, MDR/SOC, CTEM, Secure Network Access (ZTNA/SASE), and cyber resilience and recovery
- Strong threat Modeling and threat-informed Defense experience
- Strong AI/ML cybersecurity exposure, including GenAI / agentic security and AI risk governance
- Proven hands-on capability - detection engineering, automation, scripting, and building PoCs

📌 Cybersecurity Architect (Bengaluru)
🏢 Unisys
📍 Bengaluru