Архитектор по безопасности инфраструктуры и идентификации

We are looking for an Infrastructure & Identity Security Architect to define and drive our enterprise security architecture across cloud, infrastructure, networks, endpoints, and identity platforms. You will establish zero-trust security standards, develop reference architectures, and partner with engineering teams to build secure and scalable technology solutions.

Vəzifə öhdəlikləri

• Own the enterprise zero-trust target-state architecture (NIST SP 800-207) across identity, device, network, and workload pillars, setting the standards other teams execute
• Define the cloud and platform security reference architecture and standards across AWS, Azure, on-prem, and Kubernetes environments, including landing zones, account and posture baselines, SCPs/Azure Policy, secrets management, key management, certificate lifecycle, workload identity, and service-to-service authentication security guardrails that engineering teams implement.
• Define the network security architecture and reference patterns: segmentation, secure connectivity, zero-trust network access, and Firewall, WAF standards
• Define the endpoint security reference architecture: device hardening baselines, EDR architecture standards, and device-trust and posture patterns feeding zero-trust access decisions
• Define the on-prem and bare-metal infrastructure security architecture — including the on-prem AI infrastructure hosting clusters and LLM serving environments — partnering with on-prem engineering teams on target-state design
• Own the enterprise identity security architecture design — including IDM, SSO, IdP lifecycle, federation, PAM, FIDO2-based authentication, and access design for platform users and administrative access — and define the identity security requirements engineering teams implement.
• Provide architecture-stage design review and sign-off for infrastructure and identity changes, and recommend infrastructure, network, endpoint, and identity solutions and replacements through the Architecture CoE
• Define logging, monitoring, and detection architecture requirements for infrastructure and identity platforms, ensuring security-relevant events from cloud, network, endpoint, IAM, PAM, Kubernetes, and administrative activities are available for central monitoring and incident response.

Tələblər

• Zero-trust architecture design experience across identity, device, network, and workload pillars
• Cloud security architecture experience across AWS and Azure
• Network security architecture: segmentation, secure connectivity, zero-trust network access, and firewall/WAF design patterns
• Endpoint security architecture: device hardening baselines, device management, EDR architecture, and device-trust/posture design
• Experience in enterprise IAM/IDM depth: SSO, IdP, federation, and PAM
• Identity and authorization protocols: OAuth2/OIDC, SAML, SCIM, and consent/delegation models
• Familiarity with digital identity and trust services (SİMA digital signature/identity) and KYC-driven identity assurance in financial services
• Working understanding of Kubernetes cluster infrastructure (networking, node pools, control-plane connectivity) sufficient to set platform-network and connectivity standards
• Working knowledge of logging, monitoring, detection, and incident-response requirements for infrastructure and identity security controls.

Üstünlüklər

• Opportunity to learn through working
• Familiarity with a real banking environment
• Gaining practical knowledge and experience
• Development of communication and customer service skills
• Improving teamwork abilities
• Support from a professional mentor
• Chance to build a future career at Bir Ecosysem