Role & responsibilities

AWS Security Strategy and Architecture

- Define AWS cloud security strategy, target-state architecture, security principles, patterns, standards, and roadmaps aligned with business and regulatory requirements.
- Design secure, resilient, scalable, and cost-aware architectures using AWS Well-Architected security and operational principles.
- Lead architecture reviews, threat modelling, risk assessments, design assurance, and security exception evaluations for new and existing workloads.
- Create reference architectures and reusable patterns for internet-facing applications, APIs, data platforms, containers, serverless workloads, and hybrid connectivity.
- Provide technical leadership to cloud platform, engineering, DevOps, SOC, application, risk, audit, and compliance teams.

Multi-Account Governance and Landing Zone Security

- Design and secure AWS Organizations and AWS Control Tower environments, including organizational units, account vending, delegated administration, and centralized security services.
- Define and maintain preventive, detective, and proactive guardrails using service control policies, resource control policies where applicable, AWS Config, and policy-as-code approaches.
- Establish centralized logging, security tooling, network inspection, backup, incident-response, and evidence-management accounts.
- Design region restrictions, tagging controls, resource-sharing guardrails, baseline configurations, and account lifecycle security requirements.
- Assess existing landing zones and recommend improvements for governance, segregation of duties, resilience, compliance, and operational efficiency.

Identity, Access and Secrets Security

- Design workforce and workload identity architecture using AWS IAM Identity Center, IAM roles, permission sets, federation, temporary credentials, and least-privilege access.
- Define identity governance for privileged access, break-glass accounts, role assumption, service-linked roles, cross-account access, access reviews, and separation of duties.
- Use IAM Access Analyzer, credential reports, access-advisor data, and policy analysis to identify excessive or unintended access.
- Design secure secrets and key-management solutions using AWS Secrets Manager, AWS Systems Manager Parameter Store, AWS KMS, CloudHSM, and certificate services.
- Establish controls for root-user protection, MFA, access keys, credential rotation, resource policies, encryption keys, and machine identities.

Network, Edge and Infrastructure Security





- Design secure VPC architecture, subnet segmentation, route controls, security groups, network ACLs, VPC endpoints, DNS security, centralized egress, and hybrid connectivity.
- Architect inspection and protection using AWS Network Firewall, AWS WAF, AWS Shield, Route 53 Resolver DNS Firewall, Gateway Load Balancer, and approved third-party controls.
- Define secure connectivity patterns for Direct Connect, Site-to-Site VPN, Transit Gateway, PrivateLink, peering, multi-region, and hybrid-cloud environments.
- Review internet exposure, lateral-movement paths, ingress and egress controls, TLS configuration, certificate management, and network telemetry.
- Validate infrastructure hardening for EC2, load balancers, storage, databases, managed services, and administrative access paths.

Data, Workload and Application Security

- Design data-protection controls covering classification, encryption, tokenization, key ownership, backups, retention, replication, access logging, and secure deletion.
- Configure or guide use of Amazon Macie for sensitive-data discovery and AWS KMS for encryption governance.
- Define security patterns for EC2, Amazon EKS, Amazon ECS, AWS Lambda, container registries, serverless applications, databases, analytics services, and AI/ML workloads.
- Guide vulnerability management and workload protection using Amazon Inspector, Systems Manager, hardened images, patching standards, and secure configuration baselines.
- Embed security requirements into application architecture, API design, authentication, authorization, software supply chain, and third-party integrations.

Security Monitoring, Detection and Incident Response

- Design centralized logging and monitoring using AWS CloudTrail, AWS Config, Amazon CloudWatch, VPC Flow Logs, Route 53 logs, service logs, and secure log archives.
- Architect and operationalize Amazon GuardDuty, AWS Security Hub CSPM, Amazon Detective, IAM Access Analyzer, and relevant security services across accounts and regions.
- Integrate AWS security findings and telemetry with enterprise SIEM, SOAR, ITSM, threat-intelligence,



and case-management platforms.
- Define detection use cases, alert-routing models, severity and prioritization standards, investigation procedures, containment patterns, and incident-response playbooks.
- Lead cloud-security incident investigations, root-cause analysis, recovery planning, lessons learned, and control improvement activities.
- Design automated remediation using Amazon EventBridge, AWS Lambda, AWS Step Functions, Systems Manager Automation, and approved orchestration tools.

DevSecOps, Infrastructure as Code and Automation

- Embed security controls into CI/CD pipelines and software-development workflows using policy as code, automated testing, artifact assurance, and security gates.
- Design and review Infrastructure as Code developed using AWS CloudFormation, AWS CDK, Terraform, or equivalent technologies.
- Implement secure pipeline patterns for source control, build services, artifact repositories, deployment roles, signing, provenance, secrets, and setting separation.
- Drive automation for account baselining, guardrail deployment, evidence collection, security validation, remediation, and reporting.
- Partner with development teams to manage SAST, DAST, SCA, IaC, secrets, container, and API-security findings based on application risk.

Risk, Compliance and Stakeholder Management

- Map AWS controls to applicable frameworks such as CIS AWS Foundations Benchmark, NIST CSF, NIST SP 800-53, ISO/IEC 27001, PCI DSS, SOC 2, and customer policies.
- Provide architecture evidence and technical support for audits, regulatory reviews, risk assessments, and customer assurance activities.
- Define security KPIs and KRIs, architecture-decision records, risk-treatment plans, exceptions, remediation roadmaps, and executive reporting.
- Facilitate security workshops and communicate architecture decisions, risks, trade-offs, and recommendations to technical and business stakeholders.
- Mentor security engineers and architects, develop standards and runbooks, and support security capability improvement across teams.

Preferred certifications:

- AWS Certified Security - Specialty.
- AWS Certified Solutions Architect - Professional.
- Certified Information Systems Security Professional (CISSP), Certified Cloud Security Professional (CCSP), or Certified Information Security Manager (CISM).
- AWS Certified Advanced Networking - Specialty, Kubernetes security, Terraform, or relevant DevSecOps certifications are desirable.

📌 Senior AWS Security Architect (Mumbai)
🏢 Tata Consultancy Services
📍 Mumbai