Security & Compliance Architect

• JOB TITLE Security & Compliance Architect

GRADE VP

DEPARTMENT IT

LOCATION HO(Bengaluru)

REPORTS TO Head-SRE & Enterprise Architect

ROLE PURPOSE & OBJECTIVE

The Security & Compliance Architect is a strategic leadership role responsible for security architecture strategy covering application security, infrastructure security, data protection, and regulatory compliance. Ensures DPDPA 2023, RBI cybersecurity guidelines, ISO 27001, and PCI-DSS compliance. Designs security controls, IAM, and threat modeling frameworks.

KEY DUTIES & RESPONSIBILITIES OF THE ROLE

1. Business

• Define and execute the enterprise security architecture strategy aligned with the Bank’s business objectives, digital transformation roadmap, risk appetite, and regulatory obligations.
• Establish security architecture frameworks, standards, policies, and reference architectures covering applications, infrastructure, cloud, data, networks, and digital channels.
• Ensure that architecture decisions comply with applicable RBI guidelines, DPDPA 2023, ISO 27001, PCI-DSS, and the Bank’s internal information security policies.
• Translate business and regulatory requirements into practical, scalable, and risk-based security controls.
• Provide security architecture inputs for new business initiatives, technology investments, cloud adoption, third-party integrations, and modernization programs.
• Evaluate security technologies and solutions based on business value, risk reduction, integration feasibility, scalability, and total cost of ownership.
• Identify technology and cybersecurity risks at an early stage and recommend appropriate preventive, detective, and corrective controls.
• Support senior management, governance committees, audit teams, and regulators by providing security architecture inputs, risk assessments, and remediation roadmaps.
• Balance security, compliance, customer experience, operational requirements, and delivery timelines while recommending architecture decisions.

2. Customer

• Embed privacy and security by design into customer-facing applications, digital platforms, products, APIs, and business processes.
• Protect customer and payment data through appropriate data classification, encryption, access control, masking, tokenization, key management, and monitoring controls.
• Ensure customer identity and access journeys are secured through appropriate authentication and authorization mechanisms, including SSO, MFA, RBAC, and risk-based access controls.
• Support implementation of DPDPA 2023 requirements, including consent management, data minimization, purpose limitation, retention, and secure disposal of personal data.
• Minimize customer impact arising from security vulnerabilities, unauthorized access, cyberattacks, data leakage, and service disruptions.
• Ensure payment card processing solutions comply with PCI-DSS and the Bank’s payment security requirements.
• Review third-party, fintech, cloud, SaaS, and partner solutions to ensure adequate protection of customer information.
• Enable secure and seamless customer experiences by recommending controls proportionate to the business and security risks.
• Support investigation and resolution of security incidents affecting customer-facing services, with a focus on strengthening the architecture and preventing recurrence.

3. Internal Process

• Define, maintain, and govern security architecture standards, reusable patterns, control requirements, and reference architectures across on-premises, cloud, and hybrid environments.
• Design Identity and Access Management architecture covering SSO, MFA, RBAC, privileged access management, identity lifecycle management, service accounts, and access governance.
• Establish application security architecture covering Secure SDLC, OWASP Top 10, API security, secure coding, SAST, DAST, Software Composition Analysis, secrets detection, and vulnerability management.
• Design network security architecture covering firewalls, WAF, IDS/IPS, DDoS protection, secure remote access, micro-segmentation, and network zoning.
• Define data protection architecture covering encryption at rest and in transit, data masking, tokenization, PKI, certificates, HSM/KMS, key rotation, and secure key lifecycle management.
• Conduct threat modelling, security risk assessments, design reviews, and architecture security reviews for new implementations and material technology changes.
• Provide security architecture review and sign-off for applications, infrastructure, cloud, API, SaaS, and third-party integration initiatives.
• Define security monitoring architecture and integration requirements for SIEM, SOC, threat detection, logging, alerting, incident response, and forensic readiness.
• Review the existing security posture across IAM, firewalls, VPNs, WAF, endpoints, cloud platforms, applications, APIs, and monitoring tools, and recommend target-state improvements.
• Establish risk-based vulnerability remediation requirements and validate that security gaps are tracked, mitigated, and closed within approved timelines.
• Support security incident response from an architecture perspective and incorporate lessons learned into standards, designs, and control frameworks.
• Collaborate with Enterprise Architecture, Application, Infrastructure, Cloud, Data, DevSecOps, CISO, Risk, Compliance, Audit, and Operations teams to embed security requirements across the technology lifecycle.
• Maintain traceability of security observations, architecture decisions, exceptions, risk acceptances, and remediation actions.
• Present significant security risks, design deviations, and control gaps through the appropriate architecture and risk governance forums.

4. Learning & Performance

• Maintain current knowledge of cybersecurity threats, attack techniques, vulnerabilities, regulatory changes, and emerging security architecture practices.
• Continuously develop expertise in application security, API security, cloud security, identity security, data protection, cryptography, network security, and Zero Trust architecture.
• Stay updated on RBI cybersecurity requirements, DPDPA 2023, ISO 27001, PCI-DSS, NIST, OWASP, and other relevant industry standards.
• Build and maintain reusable security architecture patterns, assessment checklists, design principles, and implementation guidance.
• Mentor architects, engineers, developers, and project teams on security-by-design, privacy-by-design, Secure SDLC, threat modelling, and secure engineering practices.
• Conduct knowledge-sharing sessions and awareness programs to improve the security architecture maturity of technology teams.
• Evaluate emerging security tools, technologies, and approaches through structured assessments, proofs of concept, and architecture reviews.
• Track security architecture KPIs, review findings, remediation timelines, and compliance indicators to drive continuous improvement.
• Pursue and maintain relevant security certifications such as CISSP, CISM, CCSP, ISO 27001, cloud security, and architecture-related certifications.
• Promote a security-first culture by encouraging shared accountability for security across business, development, operations, infrastructure, cloud, and architecture teams.

MINIMUM REQUIREMENTS OF KNOWLEDGE & SKILLS

Educational

Qualifications

• B.Tech/M.Tech in Computer Science/Cybersecurity
• Post-graduate qualification is preferred.

Experience

• 12-15 years in IT Security, 6-8 years in Security Architecture, Banking essential

Certifications

• CISSP (Certified Information Systems Security Professional) mandatory
• CISA, CISM, or CEH certifications preferred
• Cloud security (Azure Security Engineer, AWS Security Specialty)
• ISO 27001 Lead Auditor certification preferred

Functional Skills

• Deep expertise in security frameworks (NIST, ISO 27001, PCI-DSS, RBI guidelines)
• Strong knowledge of IAM solutions (AD, Okta, Azure AD, SSO protocols)
• Experience with DPDPA 2023, GDPR - data protection, consent frameworks
• Application security (secure coding, OWASP, SAST/DAST tools, API security)
• Network security (firewalls - Palo Alto/Fortinet, IDS/IPS, VPN)
• Cryptography and key management (PKI, HSM, encryption algorithms)
• Security tools (SIEM - Splunk/QRadar, vulnerability scanners)
• Banking security requirements (ATM security, payment systems, CBS)