副总裁，网络安全应用架构师

Principle Duties Developer enablement & secure coding support

• Serve as the security architecture authority within the architecture organization, partnering with product architects, principal engineers, cloud partners (AWS, Azure, GCP), and business leaders to embed secure-by-design principles into hardware appliances, multi-tenant SaaS platforms, and globally distributed cloud infrastructure.

• Coach and support developers in writing secure code, including secure patterns, common vulnerability classes, and secure use of frameworks and libraries.

• Provide timely consulting on “how to do it right” (architecture, implementation details, and operational considerations) and help teams choose secure-by-default approaches.

• Triage findings from SAST, SCA, DAST, container and IaC scanning; investigate, validate, and resolve false positives; and help teams prioritize true risk.

• Partner with teams to tune security tools, reduce noise, and improve signal quality (rules, suppressions, baselines, and exception processes) while maintaining strong security posture.

• Drive adoption of CNAPP, CWPP, WAF, service mesh security, API gateways, SIEM/SOAR, and cloud-native telemetry for protective monitoring, runtime defense, and incident-ready detection.

Secure by Design reviews

• Conduct Secure by Design reviews for new applications and material changes to existing applications, validating security requirements and design decisions early.

• Lead and facilitate threat modeling workshops; identify abuse cases, trust boundaries, and attack paths; and document mitigations and residual risk.

• Review authentication/authorization design, data flows, secrets handling, logging/monitoring, and resiliency controls to ensure secure architectures.

• Provide clear, actionable recommendations and track follow-through with engineering teams.

• Translate regulatory and compliance requirements (FedRAMP, SOC2, ISO 27001, NIST SP 800-53, CSA CCM, SOX) into actionable, measurable, and auditable security architecture control objectives—shifting from audit-driven to architecture-driven alignment.

CI/CD and SDLC security

• Advise on the security of CI/CD practices pipeline hardening, least privilege, artifact integrity, signing, provenance, and secure deployment patterns.

• Advise on secure use of third-party dependencies and supply chain controls, including SCA governance and patch/vulnerability management workflows.

• Collaborate with platform/tooling teams to integrate security controls into developer workflows with a focus on automation and self-service.

AI/ML security guidance

• Provide security architecture guidance for AI/ML and GenAI-enabled applications, including model/data risk, prompt/agent design considerations, and safe integration patterns.

• Help teams implement appropriate controls for data protection, access control, monitoring, and abuse prevention in AI/ML features.

Collaboration & communication

• Act as a trusted partner to product, engineering, and leadership—translating security requirements into developer-friendly guidance.

• Create and maintain secure coding guidance, reference architectures, and reusable patterns.

• Support incident learnings by contributing to root cause analysis and preventative design improvements.

Originally posted on Himalayas