Cloud Security Architect

We are looking for an experienced and hands-on Cloud Security Architect to join our team in Hyderabad/Bhimavaram. The role requires a deep understanding of cloud-native application protection platforms (CNAPP) such as Wiz, and a strong technical foundation in securing production environments at scale. The candidate must be able to design, implement, and continuously improve security across operating systems, applications, and multi-cloud services (AWS, Azure, GCP). This role will act as a bridge between security, infrastructure, DevOps, and application teams, ensuring that security is embedded across the entire lifecycle — from architecture and design to deployment and operations — while aligning with industry best practices and compliance frameworks. Key Responsibilities: Cloud Security Architecture & Design Architect secure, scalable, resilient multi-cloud solutions; assess and uplift existing landing zones (AWS Control Tower, Azure ALZ, GCP LZ) with zero-trust patterns and segmentation. Lead adoption and tuning of CNAPP (Wiz preferred) for posture, vulnerability, CIEM, container, and compliance monitoring; integrate into incident/change workflows. Publish reference architectures and guardrails for IaaS, PaaS, containers/Kubernetes, serverless, and SaaS; embed least-privilege IAM, KMS/Key Vault/Cloud KMS, encryption in transit/at rest, tokenization, and secrets management. Partner with platform, SRE, and app teams to embed security by design (threat modeling, architecture reviews, security NFRs). Managed Cloud Security Operations (Posture, Enforcement & Optimization) Operate and continuously improve CNAPP (Wiz preferred) across AWS/Azure/GCP: tune posture policies, de-duplicate/suppress noise, drive risk-based remediation at scale. Run CSPM/CWPP/CIEM day-to-day: policy tuning, guardrails, exceptions with expiry, auto remediation via IaC/SSM/Runbooks; integrate with ticketing (Jira/ServiceNow) and track SLAs. Continuous compliance: implement policy-as-code and evidence automation; maintain dashboards/mappings for ISO 27001, SOC 2, PCI DSS, HIPAA, GDPR, NIST CSF/CIS; manage POA&Ms to closure. Identity & access guardrails: enforce least-privilege baselines, conditional access, access reviews/recertifications, break-glass controls; manage secrets/keys rotation (KMS/Key Vault/Cloud KMS, HSM). Kubernetes & container runtime ops: admission policies (OPA/Gatekeeper), image signing/verification, registry controls, runtime protections (eBPF/agents), and baseline hardening for EKS/AKS/GKE. Vulnerability & patch orchestration: coordinate OS/app/container scanning, set patch SLAs and maintenance windows, handle risk-accepted exceptions with review cadences. Data protection posture: encryption at rest/in transit, tokenization, DLP/DSPM (where applicable), data residency/sovereignty checks, and key lifecycle hygiene. SIEM/SOAR/XDR integration: normalize CNAPP/CSPM/CWPP signals, build alerting & playbooks, measure MTTD/MTTR, and lead RCA with durable fixes and control improvements. FinOps-aware security: right-size agents and telemetry, optimize license/ingest costs, and balance risk reduction with performance and spend. Reporting & stakeholder comms: weekly risk burndowns, compliance status, executive scorecards, and remediation progress across product/infra teams. Ops success metrics (examples): ≥90% critical misconfigurations remediated in top accounts within 90 days; patch-SLA compliance ≥95%; MTTR reduced ≥30%; audit findings closed on plan. Governance, Risk & Compliance Establish and maintain policies, baselines, and control mappings to ISO 27001, SOC 2, PCI DSS, HIPAA, GDPR, NIST CSF/800-53, CIS Benchmarks. Enable continuous compliance via CNAPP/cloud config rules and automated evidence collection. Lead/assist audits and security questionnaires; produce risk assessments, gap analyses, POA&Ms, and executive readouts. Threat Management & Incident Response Conduct threat modeling and attack-surface analysis (cloud, container, API); run red/blue/purple exercises for cloud scenarios. Build playbooks/integrations with SIEM/SOAR/XDR; lead/assist incident triage, forensics, RCA, and post-incident hardening. Track and mitigate evolving threats (supply chain, container/runtime exploits, misconfigurations, API abuse). Requirements: Technical Expertise Proven hands-on experience with CNAPP solutions (preferably Wiz; experience with Prisma Cloud, Orca Security, or Lacework is a plus). Strong knowledge of cloud provider security services (AWS IAM, KMS, GuardDuty, Security Hub; Azure Defender, Sentinel, Key Vault; GCP Security Command Center, IAM). Expertise in Kubernetes and container security (admission controllers, pod security policies, runtime protection, image scanning). Proficiency in operating system hardening (Linux, Windows) and application-level security. Hands-on scripting/automation experience (Python, PowerShell, Bash, Terraform, or similar). Familiarity with identity federation, secrets management, encryption, PKI, and key rotation practices. Professional Background 8–12 years of IT/security experience, with at least 4–6 years in cloud security architecture and engineering. Demonstrated track record of securing large-scale, production-grade cloud environments. Certifications strongly preferred: Cloud: AWS Certified Security Specialty, Azure Security Engineer Associate, GCP Professional Cloud Security Engineer Security : CISSP, CCSP, CISM, or equivalent Soft Skills Strong analytical and problem-solving abilities with a hands-on, solution-oriented mindset. Excellent communication and documentation skills to effectively engage senior leadership, engineers, and auditors. Ability to balance practical security with business enablement. Team player who can influence without authority and drive cross-functional initiatives. Preferred Qualifications Experience with SIEM, SOAR, and XDR solutions for cloud monitoring and incident management. Knowledge of DevSecOps pipelines with tools like GitHub Actions, Jenkins, GitLab CI/CD, or Azure DevOps. Contributions to cloud security research, open-source projects, or community forums. Apply Now If not you, know anyone who is good for this role? If yes, please refer to fathima.khanam@netenrich.com // ===== Scroll to Top ==== $(window).scroll(function() { if ($(this).scrollTop() >= 50) { // If page is scrolled more than 50px $('#return-to-top').fadeIn(200); // Fade in the arrow } else { $('#return-to-top').fadeOut(200); // Else fade out the arrow } }); $('#return-to-top').click(function() { // When arrow is clicked $('body,html').animate({ scrollTop : 0 // Scroll to top of body }, 500); }); SOLUTIONS SOLUTIONS Cyber Risk Operations Agentic SOC Cloud Detection & Response Google SecOps Solutions Google AI Threat Defense PLATFORM PLATFORM Resolution Intelligence Cloud™ RESOURCES RESOURCES All Blog Case Studies Events & Webinars Podcasts Guides COMPANY COMPANY Why Netenrich Customers About us Contact us Newsroom Careers Privacy Policies Terms & Conditions Legal Compliance Support © 2026 Copyright - All Rights Reserved by Netenrich LinkedIn YouTube Return to Top var hsVars = hsVars || {}; hsVars['language'] = 'en'; window.onload = function() { // Get all the span elements with the class 'loaded' var loadedSpans = document.getElementsByClassName('loaded'); // Loop through each span for (var i = 0; i var hamburger = document.querySelectorAll('.js-toggle-main-nav'); var hhsMenuQuickLinks = document.querySelectorAll('.hs-menu-item__quicklink'); var hhsMenuSubNavToggle = document.querySelectorAll('.js-sidebar-nav-toggle'); var sideMenuLinks = document.querySelectorAll('.js-side-menu a'); // Select all anchor links within the side menu function toggleMenu() { hamburger.forEach(item => { item.classList.toggle('active'); }); document.querySelector('.js-side-menu').classList.toggle('is-open'); document.querySelector('.body-wrapper').classList.toggle('nav-is-open'); return false; }; hhsMenuSubNavToggle.forEach(item => { item.addEventListener('click', function(e) { e.preventDefault(); this.classList.toggle('is-open'); this.parentNode.nextElementSibling.classList.toggle('is-open'); }) }); // Check if the event target or any of its parents has a specific class function hasParentWithClass(element, classname) { if (element.classList && element.classList.contains(classname)) { return true; } return element.parentNode && hasParentWithClass(element.parentNode, classname); } // Add this loop to attach event listeners to all side menu links sideMenuLinks.forEach(link => { link.addEventListener('click', function(e) { // Prevent the side menu from closing if the clicked link or any parent is a toggle button if (!hasParentWithClass(e.target, 'js-sidebar-nav-toggle')) { // Check if the clicked link is an anchor link if(this.getAttribute('href').startsWith('#')) { toggleMenu(); // Call the toggleMenu function to close the side menu } } }); }); (function() { function handleFirstTab(e) { if (e.key === "Tab") { document.body.classList.add("user-is-tabbing"); window.removeEventListener("keydown", handleFirstTab); } } window.addEventListener("keydown", handleFirstTab); })(); // THIS IS FOR THE LANGUAGE SWITCHER document.addEventListener('DOMContentLoaded', function() { // SVG markup var svgHTML = ' '; // Get all .hhs-lang-switch containers var containers = document.querySelectorAll('.hhs-lang-switch'); // Loop through each container containers.forEach(function(container) { // Check if the .globe_class exists within the current container var globeClass = container.querySelector('.globe_class'); if (globeClass) { // If .globe_class exists within the container, prepend the SVG to it globeClass.insertAdjacentHTML('afterbegin', svgHTML); } else { // If .globe_class doesn't exist, prepend the SVG to the current .hhs-lang-switch container container.insertAdjacentHTML('afterbegin', svgHTML); } }); }); document.addEventListener('DOMContentLoaded', () => { if (window.hsInEditor) { return; } // show mega menu megaMenu(924); }); $(function (e) { $('.foot-nav-title.col-head-1').click(function () { $(this).next('.hhs-foot-nav-col.nav-col-1 .hhs-col-content').slideToggle(250); $('.foot-nav-title').toggleClass('is-active'); $('.hhs-foot-nav-col.nav-col-1 .hhs-col-content').toggleClass('open-menu'); return false; }); $('.foot-nav-title.col-head-2').click(function () { $(this).next('.hhs-foot-nav-col.nav-col-2 .hhs-col-content').slideToggle(250); $('.foot-nav-title').toggleClass('is-active'); $('.hhs-foot-nav-col.nav-col-2 .hhs-col-content').toggleClass('open-menu'); return false; }); $('.foot-nav-title.col-head-3').click(function () { $(this).next('.hhs-foot-nav-col.nav-col-3 .hhs-col-content').slideToggle(250); $('.foot-nav-title').toggleClass('is-active'); $('.hhs-foot-nav-col.nav-col-3 .hhs-col-content').toggleClass('open-menu'); return false; }); $('.foot-nav-title.col-head-4').click(function () { $(this).next('.hhs-foot-nav-col.nav-col-4 .hhs-col-content').slideToggle(250); $('.foot-nav-title').toggleClass('is-active'); $('.hhs-foot-nav-col.nav-col-4 .hhs-col-content').toggleClass('open-menu'); return false; }); }); var txt = ""; txt += " Browser CodeName: " + navigator.appCodeName + " "; txt += " Browser Name: " + navigator.appName + " "; txt += " Browser Version: " + navigator.appVersion + " "; txt += " Cookies Enabled: " + navigator.cookieEnabled + " "; txt += " Browser Language: " + navigator.language + " "; txt += " Browser Online: " + navigator.onLine + " "; txt += " Platform: " + navigator.platform + " "; txt += " User-agent header: " + navigator.userAgent + " "; var _hsq = _hsq || []; _hsq.push(["setContentType", "standard-page"]); _hsq.push(["setCanonicalUrl", "https:\/\/netenrich.com\/careers\/cloud-security-architect"]); _hsq.push(["setPageId", "195593188012"]); _hsq.push(["setContentMetadata", { "contentPageId": 195593188012, "legacyPageId": "195593188012", "contentFolderId": null, "contentGroupId": null, "abTestId": null, "languageVariantId": 195593188012, "languageCode": "en", }]); var hsVars = { render_id: "ede67915-604c-42c4-9609-586050fd6ff4", ticks: 1791474874641, page_id: 195593188012, content_group_id: 0, portal_id: 128884, app_hs_base_url: "https://app.hubspot.com", cp_hs_base_url: "https://cp.hubspot.com", language: "en", analytics_page_type: "standard-page", scp_content_type: "", analytics_page_id: "195593188012", category_id: 1, folder_id: 0, is_hubspot_user: false }