About the Role:

We are seeking a highly experienced Senior Product Security Architect who will be responsible for embedding security into the entire product lifecycle, from design to deployment while enabling secure innovation at scale.

Key Responsibilities:

1. Security Architecture & Strategy:

- Define and implement product security architecture frameworks and standards.

- Integrate Security-by-Design and Privacy-by-Design principles into all products.

- Establish a long-term product security roadmap aligned with business strategy.

- Lead threat modeling and risk assessments for critical products and platforms.

- Provide architectural guidance for: Cloud-native applications, Microservices and APIs, and SaaS and enterprise platforms.

- Drive adoption of security frameworks including: NIST Secure Software Development Framework (SSDF) NIST SP 800-218 and OWASP SAMM (Software Assurance Maturity Model).

2. Secure SDLC (Software Development Lifecycle):

- Design and implement a Secure SDLC (SSDLC) framework across teams.

- Embed security controls across: Design, Development, Testing, and Deployment.

- Define and enforce: Secure coding standards, Secure coding practices, and DevSecOps integration.

- Ensure adoption of: SAST (Static Application Security Testing), DAST (Dynamic Application Security Testing), SCA (Software Composition Analysis), and Penetration Testing frameworks.

- Establish security maturity metrics and SSDLC governance aligned with NIST SSDF and OWASP SAMM.

3. Engineering & DevSecOps Enablement:

- Partner with engineering teams to shift security left.

- Drive adoption of DevSecOps practices and automation.

- Enable teams through: Security training and awareness, Secure coding guidelines, and Architecture reviews.

- Implement and govern CI/CD security controls and secure pipeline configurations.

- Act as a trusted advisor to engineering leadership.

4. Vulnerability & Risk Management:

- Oversee application and product vulnerability management lifecycle.

- Define prioritization frameworks based on: Risk severity and Business impact.

- Drive remediation programs and SLAs.

- Conduct: Penetration testing reviews and Security assessments.

- Interpret and prioritize findings from SAST, DAST, SCA, and penetration testing activities.

5. Cloud & Infrastructure Security:

- Provide security architecture for: AWS / Azure / GCP environments and Container security (Docker, Kubernetes).

- Define controls for: Identity & Access Management (IAM), Data protection (encryption, key management), and Network security.

6. Regulatory Compliance & Governance:

- Ensure compliance with industry standards: ISO 27001, SOC 2, and GDPR and Data Privacy regulations.

- Implement audit-ready processes and controls.

- Partner with risk teams for: Security audits and Compliance assessments.

7. Leadership & Stakeholder Management:

- Lead and mentor a team of Product Security Engineers and Architects.

- Collaborate with: Engineering leadership, Product management, Cybersecurity teams, and External vendors and partners.

- Influence senior stakeholders on: Security investments, Risk posture, and Strategic priorities.

8. Incident Readiness & Response:

- Support security incident handling related to product vulnerabilities.

- Define incident response playbooks for product security risks.

- Conduct post-incident reviews and improve controls.

Experience:

- 12-18 years of experience in: Application Security, Product Security, Security Architecture, and DevSecOps.

- Proven experience in a leadership role (Senior Manager / Architect level).

- Hands-on expertise in: Secure application design, Threat modeling, Security architecture, and Secure SDLC implementation.

Technical Skills:

- Strong knowledge of: OWASP Top 10, Secure coding standards, API security, NIST Secure Software Development Framework (SSDF) SP 800-218, and OWASP SAMM (Software Assurance Maturity Model).

- Experience with: Cloud security (AWS / Azure / GCP), Container and Kubernetes security, CI/CD pipelines and DevOps tools, Implementation of CI/CD security controls and secure pipeline configurations, and DevSecOps frameworks and automation.

- Strong understanding of: SAST (Static Application Security Testing), DAST (Dynamic Application Security Testing), SCA (Software Composition Analysis), Penetration Testing methodologies and frameworks, and Security testing and vulnerability remediation workflows.

- Familiarity with: SIEM and monitoring tools, and Security orchestration and automation tools.

Certifications (Preferred):

- CISSP (Certified Information Systems Security Professional), CSSLP (Certified Secure Software Lifecycle Professional), CISM / CISA, AWS Security Specialty, Microsoft Azure Security Engineer, and Relevant DevSecOps or Cloud Security certifications.

Leadership Competencies:

- Strategic thinking with strong execution focus.

- Ability to influence without authority.

- Strong stakeholder management at the leadership level.

- Problem-solving and risk-based decision making.

- Ability to translate technical risks into business impact.

- Strong communication and executive presentation skills.

Success Metrics (KPIs):

- Reduction in critical vulnerabilities across products.

- Adoption rate of Secure SDLC practices.

- Improvement in security posture and audit outcomes.

- Reduction in time-to-remediation.

- Increased awareness and secure coding adoption across teams.

- Improvement in SSDLC maturity and DevSecOps adoption.