Job Title: Security Architect

Location: Mumbai, Maharashtra (Hybrid)

Summary of Role The Security Architect owns the secure architecture and design assurance theme within WTW's Application Security Centre of Excellence in HWC Technology, one of the three practices the COE executes directly. The role closes the secure-architecture finding from the OWASP SAMM assessment across the top platforms by performing independent, objective architecture reviews and ensuring that architecture and design artefacts explicitly reference the applicable security standards and design principles. The individual defines the review methodology, inputs and triggers, validates vendor outputs against WTW's own standards, and works with Enterprise Architecture to settle where secure-architecture review sits for the long term.

Reporting to the Application Security CoE Lead, the role operates in line with DORA, CAP, NIST, OWASP, ISO 27001 and InfoSec guardrails.

The Role

- Secure Architecture Review Practice & Methodology
- Define and own the secure-architecture-review (SAR) methodology, the inputs required to enable a review, and the triggers that instigate one.
- Ensure architecture and design artefacts explicitly reference security standards and secure-design principles, and provide the independent, objective assessment that today is lacking.
- Define what “done” looks like and validate outputs against NIST, OWASP, ISO 27001 and SAMM thresholds with ICS and external audit.
- Delivery across the top platforms
- Lead secure architecture reviews across the in-scope platforms for the Health & Perks Platform and Work & Rewards.
- Review and uplift vendor architecture-review outputs so they draw on WTW's own InfoSec policies and standards rather than reading as off-the-shelf.




- Own end-to-end closure of the secure-architecture SAMM finding and the ongoing ownership mechanism after vendor hand-off.
- Embedding into the SDLC & AI Enablement
- Embed secure-by-design practice, reference architectures, guardrails and patterns into the SDLC and DevSecOps pipelines.
- Apply AI and automation to assist and scale design review, with human-in-the-loop validation.
- Direct relevant tooling with ICS, balancing value against cost.
- Architecture Ownership & Adjacent Scope
- Partner with Enterprise Architecture to agree where secure-architecture review sits for the long term and how it interfaces with the CoE.
- Align reviews to Azure security guardrails and to the adjacent environment-isolation, network-segmentation and API-security work as it matures.
- Enablement, Governance, Stakeholders & Vendor
- Coach LOB architects and security champions, and create a culture in which secure design is the default.
- Partner with InfoSec, Cryptography and Enterprise Architecture; rebuild confidence where outputs are perceived as low-value.
- Support the vendor transition for the architecture-review stream, including scope, resourcing and knowledge transfer.

The Requirements

Minimum Qualifications

- 12-16 years in technology, with 5+ years in security architecture or a senior architecture role.
- Demonstrable secure-architecture experience: secure-design patterns, reference architectures and independent architecture reviews.
- Strong Azure cloud security knowledge, including network segmentation, environment isolation and API security.
- Experience embedding secure-by-design into Agile delivery and DevSecOps.

Preferred Qualifications

- Insurance or financial-services industry experience.
- Security or architecture certifications (CISSP, CCSP, SABSA, TOGAF) and/or Azure certifications.
- Experience applying AI and automation to architecture assurance.
- Experience leading reviews across distributed teams and vendor-delivered programmes.

📌 Application Security Architect (Mumbai)
🏢 Impellam Group
📍 Mumbai