Senior Manager - Information Security

Location: Bengaluru

Profile
- Senior Manager - Information Security
Exp- 8+
Location  Bengaluru, India (hybrid) — global remit across US, India, Colombia, Philippines
Team  Security architects and domain specialists (application, infrastructure, cloud)
Role Purpose

Modern enterprises do not get breached in the application or in the infrastructure — they get breached in the space between them. APIs, data pipelines, service handoffs, and integration layers form a seam that traditionally has no single owner: application security regimes stop at the code boundary, infrastructure security regimes stop at the host and network boundary, and the integration fabric between them is under-governed by both.
The Security Architect owns end-to-end security architecture across the enterprise — application security, infrastructure security, and, explicitly, the integration seam between them. The mandate is to design, standardise, and defend the security architecture of a hybrid, multi-cloud, high-volume data environment operating across four geographies and a 30,000+ workforce handling regulated healthcare data.
What This Role Is — and Is Not
This is a security architecture role, not a GRC role.  The incumbent is a practising technologist who designs and reviews systems at the whiteboard and in the design document — not an audit, compliance, or risk-register manager. Candidates whose background is predominantly GRC, audit coordination, or compliance programme management will not be considered for this position, regardless of seniority. Familiarity with regulatory context (HIPAA, HITRUST, SOC
2) is expected as environmental literacy — it is not the job.

Key Responsibilities
1. Enterprise Security Architecture Ownership
Define and maintain the target-state security architecture, reference architectures, and reusable secure design patterns across on-premise, hybrid, and multi-cloud estates.
Chair the security design review board; every significant platform, product, and integration passes through architecture review with documented control decisions.
Set hardening and configuration baselines at the operating system level (Windows and Linux), and defend them against engineering pushback with technical argument, not policy citation.
2. Application Security Architecture
Own secure-by-design standards across the SDLC: threat modelling, secure design review, cryptographic standards, secrets management, and App Sec tooling architecture (SAST, DAST, SCA, secrets scanning).
Define API security architecture end to end: authentication and authorisation models (OAuth 2.0, OIDC, mTLS, service-to-service trust), gateway patterns, schema and payload validation, rate limiting, and abuse detection.
3. Infrastructure Security Architecture
Architect network segmentation, zero-trust access, identity and privileged-access architecture, and endpoint security integration across data centres and cloud.
Own workload security architecture in a multi-cloud environment: landing zones, container and Kubernetes security, infrastructure-as-code review, and cloud-native control selection (CSPM, DSPM, CNAPP alignment).
4. The Integration Seam — Explicit Mandate
Own security architecture for the layer where application and infrastructure regimes meet: API gateways and service meshes, middleware and message queues, data ingestion and ETL/ELT pipelines, file-transfer and B2B handoffs, and third-party integrations.
For every material data flow, establish explicit control ownership at each hop — ingestion, staging, transformation, serving, consumption — so that no handoff is unowned and no control assumption is implicit.
Design trust boundaries and data-in-motion protections across environment transitions (on-prem to cloud, cloud to cloud, enterprise to partner).
5. Leadership…