Qureos Mentor

Tata Digital

<div><div><b>About Us</b>: Tata Digital is a future-ready company that focuses on creating consumer-centric, high-engagement digital products. By creating a holistic presence across various touchpoints, we aim to be the trusted partner of every consumer and delight them by powering a rewarding life. The company's debut offering, Tata Neu, provides an integrated rewards experience across various consumer categories like groceries, fashion and electronics, travel and hospitality, health and fitness, and financial services on a single platform. Founded in 2019, Tata Digital Private Limited is a wholly owned subsidiary of Tata Sons Private Limited.</div><br>
<div></div>
<div><b>
Our Culture:</b> We cultivate a culture of innovation, inclusion for all employees and respect their individual strengths, views, and experiences. We thrive on the diversity of our talent in all forms and see it as a strength in building high performance teams across brands. As we rewrite commerce in India, change is the only constant in our day to day lives.</div><br>
<div></div>
<div><b>
Role Overview</b>: The Cloud and Network Security Architect is responsible for designing and reviewing secure architecture across multicloud (AWS, Azure, GCP) and enterprise networks, enabling secure, scalable, and compliant infrastructure for applications and services. This includes network segmentation, perimeter security (WAF, DDoS, Bot Management), Network Reviews, CSPM/CNAPP deployment, and security hardening of cloud-native and hybrid workloads.</div><br>
<div></div>
<div><b>
Key Responsibilities</b>:
</div><div><b>Cloud Security Architecture (Multicloud)</b></div>
<ul>
<li>Design and implement secure landing zones in AWS, Azure, and GCP, including account structure, VPC/VNet, IAM, and governance.</li>
<li>Define and enforce guardrails via Service Control Policies, Azure Policies, and Organization-level controls.</li>
<li>Implement, configure and manage CSPM and CNAPP tools (e.g., Wiz, Prisma Cloud, Orca) to monitor misconfigurations, vulnerabilities, and exposure.</li>
<li>Architect secure use of PaaS services, Kubernetes clusters (EKS, AKS, GKE), serverless, and containerized workloads.</li>
<li>Embed security architecture into DevOps pipelines and Infrastructure as Code (IaC) using Terraform or CloudFormation.</li></ul><br>
<div></div>
<div><b>
Network Security Architecture &amp; Segmentation</b></div>
<ul>
<li>Design secure network segmentation models (north-south, east-west) across cloud and hybrid networks.</li>
<li>Architect and maintain DMZs, internal service zones, bastion networks, and shared services VPCs/VNets.</li>
<li>Define micro segmentation policies using NSGs, Security Groups, and firewall rules.</li>
<li>Integrate Zero Trust Network Access (ZTNA) principles across user and service connectivity paths.</li></ul><br>
<div></div>
<div><b>
Perimeter &amp; Edge Security</b></div>
<ul>
<li>Architect and implementation of Web Application Firewalls (WAFs) across platforms (Akamai, Cloudflare, AWS WAF, Azure WAF).</li>
<li>Manage and configure policies of WAF, Bot Manager, DDoS protection</li>
<li>Integrate Bot Manager policies to protect APIs and customer-facing portals from automated abuse.</li>
<li>Define public/private endpoint strategy for critical services, APIs, and admin interfaces.</li></ul><br>
<div></div>
<div><b>
Security Hardening &amp; Configuration Management</b></div>
<ul>
<li>Define and enforce cloud service hardening baselines using CIS Benchmarks or custom policies.</li>
<li>Harden cloud-native network services (e.g., VPC peering, Private Link, Transit Gateway, Azure VNet Peering).</li>
<li>Review and optimize NSGs, Security Groups, firewall configurations, and VPC routing for least privilege.</li>
<li>Ensure encryption at rest/in transit, disable insecure protocols, and enforce TLS version control.</li></ul><br>
<div></div>
<div><b>
Cloud Identity &amp; Access Management (IAM)</b></div>
<ul>
<li>Architect federated access (SSO, SAML/OIDC) for cloud platforms using Identity Providers (Azure AD, Okta, etc.).</li>
<li>Design and enforce least privilege roles, permission boundaries, and JIT access controls.</li>
<li>Monitor and remediate privilege escalations, excessive permissions, and service account risks.</li></ul><br>
<div></div>
<div><b>
Security Monitoring &amp; Compliance Enablement</b></div>
<ul>
<li>Define architecture to support SIEM integration from cloud logs</li>
<li>Enable audit logging and threat detection integrations across CNAPP, WAF, DDoS, and network logs.</li>
<li>Support evidence generation for PCI DSS, RBI, and ISO 27001 audits and assessments.</li></ul><br>
<div></div>
<div><b>
Qualifications:</b>
</div><ul><li>8-10 years of hands-on experience in cloud and network security engineering or architecture</li>
<li>Strong understanding of OSI model, routing, VPNs, firewall technologies, WAF, DDoS, Bot Manager solution</li>
<li>Strong knowledge of cloud-native network security controls.</li>
<li>Hands-on experience in architecting secure, scalable, and compliant cloud infrastructure.</li>
<li>CISSP or GIAC GSEC/GXPN (plus, not mandatory)</li></ul></div>

Lead Architect - Network Security

Join Tata Digital and explore 1   exciting career opportunities. They're hiring for various roles with options for remote or on-site work. Apply today and become part of their innovative team.

Tata Digital

ABOUT_COMPANY

Lead Architect - Network Security