Principal Digital Security Architect

Другое

• Key Responsibilities  1. API & Ecosystem Architecture  ● The API Fortress: Architect the security layer for our API Gateway (e.g., Kong,  Apigee, AWS Gateway). Define global policies for Rate Limiting, Throttling, and  Authorization (preventing BOLA/IDOR attacks).   ● Supply Chain Security: Design secure integration patterns for our 3rd party partners  (Fintechs, Credit Bureaus, Payment Processors). Ensure their insecurities do not  become our breaches.  ● Microservices Mesh: Define how our internal services trust each other. Move from  "Network Trust" to "Cryptographic Trust" using mTLS and Service-to-Service  authentication. 
• 2. Identity & Access Management (CIAM)  ● Identity Strategy: Own the architecture for Customer Identity (CIAM). Design flows for  Biometric Binding, Adaptive MFA, and Step-Up Authentication for high-value  transactions.  ● Token Lifecycle: Define the standards for OAuth 2.0 and OpenID Connect (OIDC).  Ensure we are using Financial-grade API (FAPI) standards for token issuance,  revocation, and storage. 
• 3. Secure Development Lifecycle (SDLC)  ● Threat Modeling: Lead "Whiteboard Hacking" sessions with product owners. Identify  business logic flaws (e.g., race conditions in ledgers, bypassable KYC steps) before a  single line of code is written.  ● Paved Roads: Work with DevOps to architect secure-by-default libraries. (Example:  Create a standard "Encryption Wrapper" library that all developers must use, so they  don't invent their own crypto). 
• 4. Data Privacy & Cryptography  ● Data Defense: Define the architecture for Field-Level Encryption (FLE) in the  database for PII and Banking Secrets.  ● Privacy Engineering: Architect systems that support "Right to be Forgotten"  (GDPR/CCPA) without breaking the immutability of the financial ledger.  Strategic Deliverables  ● Identity Patterns: Deliver new security design patterns and components for  authentication, authorization, SSO, MFA, and Partner security to ensure seamless and  secure user access.  ● Mobile & Edge: Deliver new security design patterns and components for Mobile  security, ensuring consistency between iOS, Android, and the backend.  ● Modern Tech Stack: Deliver API, container, cloud, and AI security desig
• What We Are Looking For 
• 1. The Background  ● 8+ Years Experience: A mix of Software Engineering and Security Architecture.  ● Ex-Developer: You must be able to read code (Java, Kotlin, React or Node.js, ).   ● Banking/Fintech Experience: Strong preference for candidates who have secured  payment gateways, ledgers, or wallets. 
• 2. The Technical Skills  ● API Security: Deep mastery of REST and GraphQL security.  ● Auth Protocols: You can draw the OAuth 2.0 Authorization Code Flow with PKCE  from memory. You understand JWT signing and JWKS key rotation.  ● Mobile Security: Understanding of how mobile apps store secrets  (KeyStore/Keychain) and how to prevent API abuse from emulators/bots. 
• 3. The Mindset  ● Business Aligned: You understand that a bank exists to process transactions. You  design security that reduces risk without destroying the User Experience (UX).  ● Pragmatic: You know when to demand a "Blocker" fix and when to accept a "Risk  Acceptance" waiver.