Cybersecurity Architecture & Governance Lead

*This is a contractual role

Seniority: Senior Leadership / Technical Lead Experience: 12-18+ years in Cybersecurity, Information Security, Security Architecture, or IT Risk Management

ROLE OVERVIEW

NeGD is seeking a senior cybersecurity professional to lead security architecture, cybersecurity governance, risk management, compliance, and security assurance across government digital platforms and e-Governance programmes. The role requires robust technical and governance expertise, including the ability to prepare and evaluate complex cybersecurity RFPs and define security requirements for large-scale procurements.

KEY RESPONSIBILITIES

Security Architecture & Engineering

- Define cybersecurity reference architectures, security standards, and security-by-design principles for digital platforms and shared technology services.
- Review applications, infrastructure, cloud, API, identity, network, database, and data security architectures.
- Establishcontrols for identityand access management, privileged access, encryption, key management, secrets management, and secure connectivity.
- Guide Zero Trust principles, defence-in-depth, secure DevOps, and DevSecOps practices.
- Review threat models, attack surfaces, architecture risks, and proposed security controls.

Cybersecurity Governance, Risk & Compliance
- Establishcybersecurity governance frameworks, risk assessment processes, security baselines, and control assurance mechanisms.
- Assess compliance with applicable CERT-Indirections, MeitY guidelines, relevant Government of India securitypolicies, and other applicable requirements.
- Coordinate security audits, vulnerability assessments, penetration testing, configuration reviews, and remediation tracking.
- Define security policies, procedures, risk registers, exception-management processes, and compliance reporting.
- Support security assurance and audit readiness for government digital infrastructure and applications.

Complex RFPs & Technical Evaluation
- Lead preparation and review of complex RFPs,SoWs, technical specifications, and procurement documents for cybersecurity products, services, and managed security operations.
- Define requirements for SOC/SIEM, SOAR,EDR/XDR, IAM/PAM, WAF, API security, vulnerability management, application security, and data protection.
- Develop security compliance matrices, technical evaluation criteria, scoring methodologies, SLAs, KPIs, and measurable acceptance criteria.
- Evaluate vendor proposals, security architectures, productcapabilities, implementation approaches, licensing models, and total cost of ownership.
- Review managed securityservice provider proposals, SOC operating models,incident response capabilities, and service commitments.
- Identify gaps in vendor claims,interoperability, integration requirements, security coverage,



licensing, and long-term operational costs.
- Support pre-bid meetings,technical clarifications, demonstrations, proof-of-concept assessments, and technical committee evaluations.

Security Operations & Incident Readiness
- Define security monitoring, incident response, escalation, reporting, and remediation frameworks.
- Oversee security postureassessments, threat intelligence integration, vulnerability prioritization, and risk-based remediation.
- Establish requirements for log management, audit trails, security event correlation, and evidence retention.
- Guide incident response exercises, disaster recovery security reviews, and cyber resilience assessments.
- Coordinatewith relevant government security agencies, auditors, implementation partners, and incident responseteams as required.

Application & Platform Security
- Review secure SDLC practices, source-code security, dependency management, container security, API protection, and CI/CD pipeline controls.
- Define requirements for SAST, DAST, software composition analysis, penetration testing, and vulnerability remediation.
- Evaluate security controls for cloud-native applications, microservices, shared platforms, and third-party integrations.
- Promote security automation, continuous compliance monitoring, and security testing throughout the development lifecycle.
- Integrate security-by-design controls throughout the AI Development Life Cycle (AIDLC), including AI-specific threat modelling, data protection, model security, validation, deployment, and continuous monitoring.

Leadership & Stakeholder Management
- Provide technical direction to project teams, cybersecurity consultants, auditors, and system integrators.
- Coordinate with government departments, programme owners, procurement teams, and senior management.
- Review security assessment reports, risk acceptance requests, audit findings, and remediation plans.
- Present cybersecurity risks, compliance status, investment priorities, and mitigation recommendations to senior leadership.

REQUIRED QUALIFICATIONS & EXPERIENCE
- Bachelor’s degree in computer science, Information Technology, Cybersecurity, Engineering, or a relateddiscipline; relevant postgraduate qualifications are desirable.
- 12-18+ years of experience in cybersecurity, information security, security architecture, or enterprise risk management.




- Proven experience designing and reviewing security architectures for enterprise-scale or mission-critical platforms.
- Demonstratedexperience preparing or evaluating complexcybersecurity RFPs, tenders,technical specifications, and vendor proposals.
- Strong understanding of cybersecurity governance, risk management, securityaudits, incident response, and regulatory compliance.
- Experience with government digital platforms, public-sector programmes, or regulated environments is highly desirable.
- Apply the AI Development Life Cycle (AIDLC) framework to assess, design, and govern secure cloud architectures for AI-enabled government platforms, ensuring cybersecurity-by-design across infrastructure readiness, data protection, identity and access management, secure model development, deployment, scalability, continuous monitoring, threat detection, compliance, risk management, and lifecycle optimization in alignment with government security standards and regulatory requirements.

TECHNICAL SKILLS

- Security architecture, threat modelling, risk assessment, and security control frameworks.
- Cloud security across AWS, Azure, and/or GCP.
- SOC/SIEM, SOAR, EDR/XDR, IAM/PAM, WAF, API security, and vulnerability management.
- Secure SDLC, DevSecOps, application security, container security, and CI/CD security.
- Security auditing, penetration testing oversight, incident response, and compliance reporting.
- RFP preparation, technical scoring matrices, SLA definition, and vendor assessment.

CERTIFICATIONS & PREFERRED EXPERIENCE
- Certifications such as CISSP, CISM, CCSP, or CISA are desirable.
- Cloud security, ISO 27001, or other recognized cybersecurity certifications are an advantage.
- Experiencecoordinating with CERT-In-empanelled auditors and STQC or otherrelevant assessment bodiesis desirable, where applicable.

KEY COMPETENCIES

- Strong security architecture and risk-based decision-making.
- Excellent technical documentation, RFP drafting, and vendor evaluation skills.

- Ability to translate security risks into actionable technical and procurement requirements.
- Strong communication and stakeholder management capabilities.
- Ability to balance security, compliance, implementation feasibility, operational readiness, and cost.

EXPECTED OUTCOMES

- Consistent security architecture and governance across digital programmes.
- Improved cybersecurity posture, audit readiness, and risk visibility.
- Comprehensive, measurable, and technically sound cybersecurity procurement specifications.
- Effective vendor selection and improved security service accountability.
- Stronger incident preparedness and continuous security assurance.

Common expectation: The role requires independent assessment of complex technology proposals and the ability to balance technical suitability, security, compliance, lifecycle costs, scalability, and long-term sustainability.

📌 Cybersecurity Architecture & Governance Lead (Delhi)
🏢 National e Governance Division
📍 Delhi