Senior Security Architect

Job Title: Sr Security Architect

Reports to (Direct Title): Sr. Manager, Threat Intelligence

Department: Cybersecurity Operations

Position Summary

This role secures the multi-cloud infrastructure behind Black Duck's SaaS platforms. The Sr Security Architect will work on cloud security controls from design to operation: maintaining the baseline, finding where the environment departs from it, and working with engineering and platform teams until the risk is closed. The role is hands-on in the tooling and in the code, and automates anything done more than twice. This role works with broad autonomy and carries project-level technical leadership. The role leads cloud security projects or parts of larger initiatives, act as a technical resource for less experienced team members, and communicates risk clearly to technical teams and management. 

Essential Functions/Responsibilities

• Contribute to and maintain Black Duck's cloud security baseline: standards, guardrails, and reference configurations for GCP, Azure, and AWS, written so engineering teams can actually apply them.

• Design, build, and operate preventive and detective controls for SaaS workloads, including identity and access (IAM, workload identity, service accounts), network segmentation, encryption and key management, secrets handling, and logging coverage.

• Operate, tune, and enhance the cloud-native application protection platform (Wiz or comparable CNAPP): onboarding cloud accounts and Kubernetes clusters, writing and tuning policies and custom controls, cutting noise, and maturing coverage from agentless scanning to runtime sensors.

• Triage posture, vulnerability, and identity findings by real exposure and exploitability, not by raw severity, then partner with resource owners to prioritize and complete remediation, tracked against policy SLAs.

• Conduct security reviews and provide recommendations for new cloud services, architectures, and third-party integrations, using threat modeling and proofs of concept, before they reach production.

• Secure containerized and Kubernetes platforms (GKE, AKS, EKS): cluster hardening, RBAC, admission control and policy as code, image provenance, and runtime protection.

• Build security into CI/CD and infrastructure-as-code workflows (IaC scanning, image scanning, secrets detection, policy gates) so issues are caught before deployment rather than found in production.

• Contribute to software supply chain integrity for build and deployment pipelines, consistent with Black Duck's position as a software supply chain security company.

• Develop and maintain cloud detections from audit logs, control-plane events, and CNAPP signals; validate that the telemetry they depend on is actually collected.

• Support the CSIRT on cloud incidents: scoping, containment, evidence preservation, cloud forensics, and remediation, including post-incident hardening.

• Automate controls, enrichment, and remediation workflows using Python, Bash, cloud APIs, and infrastructure as code (Terraform, Helm).

• Lead defined cloud security projects and contribute to workstreams within complex cross-functional initiatives across engineering, platform, IT, and vendor partners.

• Provide technical guidance to less experienced team members, participate in peer reviews, and share cloud security best practices.

• Communicate cloud security risks and recommended actions to technical teams and management, supporting senior-level discussions as needed.

• Produce evidence and control documentation that supports SOC 2 and ISO 27001 audits and customer security reviews.

• Keep current on cloud attack techniques, provider security changes, and emerging threats, and recommend systematic improvements.

• Other tasks and activities as assigned.

Required Education/Experience & Skills

• Experience: typically 5 or more years in information security, including at least 3 years hands-on securing production cloud environments at scale.

• Cloud depth: in-depth conceptual and practical knowledge of at least one major provider (GCP, Azure, or AWS) and working fluency in a second, covering IAM models, networking, logging, and native security services. Production experience with GCP and Azure is a strong advantage.

• Kubernetes and containers: hands-on experience securing Kubernetes clusters and container workloads in production.

• CNAPP: hands-on experience with Wiz or a comparable CNAPP, especially policy development, custom controls, and runtime sensor deployment; plus cloud logging, monitoring, and vulnerability management platforms at scale.

• Automation: strong Python and/or Bash for security automation and integration; comfortable working directly with cloud provider APIs.

• Infrastructure as code: practical experience with Terraform, Helm, or equivalent, including reviewing IaC for security issues.

• Compliance: familiarity with SOC 2, ISO 27001, and FedRAMP frameworks (framework knowledge).

• Leadership: experience leading projects or parts of complex projects and building consensus across teams.

• Communication: strong written and verbal English; able to explain complex or sensitive security issues to technical and executive audiences.

• Education: Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent practical experience. Relevant certifications are a plus (e.g., CKS, Google Professional Cloud Security Engineer, Microsoft Azure Security Engineer Associate, AWS Certified Security Specialty, CCSP, CISSP, or GIAC).

Physical Requirements

General office environment and responsibilities requiring:

• Extensive use of the computer which involves viewing a monitor and keyboarding for most of the workday

• Placing and receiving phone calls

• Occasionally moving and lifting objects up to 20 pounds

• May require some travel as needed.