New opportunity

Security Architect

Cognizant · Chennai, India

About this role

As an Associate Director – Security Architecture Assurance & AI Security Validation, you will lead Cognizant's Cybersecurity Architecture & Risk (CAR) practice within the Extended CISO Tower. You will own independent validation that implemented controls meet security reference architecture and design requirements, extended to cover AI and Generative AI systems.

Responsibilities

Lead and mature the Security Control Evaluation function across platform, infrastructure, application and vendor implementations.
Establish and own an AI Security Validation capability against model poisoning, prompt injection, data poisoning/leakage, model inversion, adversarial and deepfake attacks.
Embed AI-TRiSM principles into the enterprise control-assurance lifecycle.
Define and govern key performance metrics, KRIs and SLOs for validation deliverables and remediation follow-ups.
Act as the primary liaison between Enterprise Architects, Design Review, CS and IT teams, and business stakeholders.
Provide deep subject-matter expertise in cybersecurity principles including cloud security posture and zero-trust validation.
Strengthen Identity & Access Management (IAM) and Third-Party Risk Management (TPRM) control validations.
Build, mentor and coach a high-performing validation team.

Required qualifications

15+ years of experience in information security, including 6+ years in security architecture / go-live control validation and 5+ years leading and mentoring teams.
Bachelor's degree in Computer Science, Information Technology, Cybersecurity or a related field.
CISM (Certified Information Security Manager) required.
Proven, hands-on experience validating security controls for cloud and on-prem solutions against a security reference architecture.
Demonstrated understanding of AI/ML and Generative AI security risks and control frameworks.

Preferred qualifications

CISSP, CISA, CCSK / CCSP.
Azure AZ-500, SC-300 / SC-100 and cloud-provider security certifications.
Emerging AI security credentials such as ISACA AAISM / AAIA.
ISO/IEC 42001 Lead Auditor/Implementer.
Experience with security automation, control-as-code, and continuous controls monitoring (CCM).

This is a hybrid position requiring 2 days a week in a Cognizant office in Chennai, Bangalore, or Pune, India.

For full details about this role, click “Apply on company site” to view the employer’s original posting.

Skills for this role

AI SecurityGenerative AILLMsAI-TRiSMNIST AI RMFISO/IEC 42001OWASP Top 10 for LLMsMITRE ATLASCloud SecurityAWSAzureGCPOCIIAMTPRMZero-Trust

Checking your profile…

Preparation suggestions, not the employer’s actual interview questions. Always check the original posting for current requirements.

Understand the role

What matters most

Establishing AI Security Validation
Build and own an end-to-end validation capability for LLMs, Generative AI, and agentic AI systems to protect against prompt injection, model poisoning, data leakage, and adversarial attacks using frameworks like NIST AI RMF, ISO/IEC 42001, and MITRE ATLAS.
Scaling Cloud and On-Premise Control Evaluation
Lead and mature the security control evaluation function across multi-cloud environments (AWS, Azure, GCP, OCI) and on-prem implementations, ensuring all architectural designs meet enterprise policies and zero-trust principles before production release.
Embedding AI-TRiSM and Lifecycle Governance
Incorporate AI Trust, Risk, and Security Management principles—including model provenance, data lineage tagging, guardrails, and red-teaming—directly into the enterprise control-assurance lifecycle.
Cross-Functional Stakeholder Leadership and Remediation
Act as the primary liaison between Enterprise Architecture, Design Review, IT Security, and business stakeholders to identify control gaps, define KRIs and SLOs, and drive remediation to closure.

Likely challenges to think through

Balancing Speed of AI Innovation with Rigorous Control Validation
Rapid deployment cycles for Generative AI and agentic applications can conflict with thorough pre-production security reviews. Prepare by designing scalable, automated validation playbooks and control-as-code mechanisms that integrate seamlessly into fast-paced development pipelines.
Mitigating Emerging, Non-Deterministic AI Vulnerabilities
Traditional security reference architectures may not fully cover probabilistic risks like prompt injection or model inversion. Prepare by deeply mastering frameworks such as OWASP Top 10 for LLMs and MITRE ATLAS to establish robust evaluation standards for AI-specific attack vectors.
Aligning Multi-Cloud and Third-Party Supply Chain Security
Enforcing uniform zero-trust standards, IAM controls, and Third-Party Risk Management (TPRM) across diverse vendor ecosystems and cloud providers (AWS, Azure, GCP, OCI) presents significant complexity. Prepare by demonstrating strong expertise in multi-cloud security postures and supply-chain model assurance.

Practice your answers

Technical practice

Validating Controls Against Security Reference Architectures

What to coverDiscuss your hands-on experience in independently verifying that cloud and on-premises implementations adhere to enterprise security reference architectures. A strong response should cover pre-production review workflows, identifying architectural drift, and enforcing compliance across multi-cloud environments like AWS, Azure, GCP, or OCI.

AI Security Validation and LLM Vulnerability Mitigation

What to coverExplain how you establish an AI security validation capability against threats such as prompt injection, model poisoning, data leakage, and adversarial attacks. Candidates should reference frameworks like OWASP Top 10 for LLMs, NIST AI RMF, and MITRE ATLAS when detailing their testing and mitigation strategies.

Embedding AI-TRiSM Principles into the Control Lifecycle

What to coverHow do you operationalize AI Trust, Risk, and Security Management (AI-TRiSM) principles—such as model provenance, data lineage tagging, and continuous monitoring—into the enterprise control-assurance lifecycle? Discuss practical guardrails and red-teaming methodologies for generative AI systems.

Cloud Security Posture and Zero-Trust Network Micro-Segmentation

What to coverDetail your approach to managing risk across data processing, storage, and transmission in cloud-native infrastructures. Address how you validate zero-trust architecture, network micro-segmentation, and cloud security posture management (CSPM) controls prior to production release.

Identity and Access Management (IAM) Control Validation

What to coverWhat is your methodology for strengthening IAM control validation across privileged access, least-privilege enforcement, joiner-mover-leaver processes, and non-human machine or AI-agent identities? Emphasize how you prevent unauthorized lateral movement and privilege escalation.

Third-Party Risk Management (TPRM) and Supply Chain Assurance

What to coverHow do you incorporate TPRM control checks into vendor and SaaS/AI-vendor go-live validations? A complete answer should address supply-chain and model-supply-chain assurance, evaluating third-party dependencies, and mitigating external integration risks.

Governance via Metrics, KRIs, and SLOs

What to coverDescribe how you define and govern key performance metrics, Key Risk Indicators (KRIs), and Service Level Objectives (SLOs) for security validation deliverables. Explain how you track remediation follow-ups and report security posture status to executive leadership.

Security Automation and Continuous Controls Monitoring (CCM)

What to coverDiscuss your experience with security automation, control-as-code, and continuous controls monitoring (CCM) as a method to scale security control evaluation. Address how automation reduces friction between development velocity and security assurance.

Behavioural practice

Leading Security Architecture Across Competing Stakeholder Priorities

What to coverDescribe a situation where you had to act as a primary liaison between technical teams, enterprise architects, and business stakeholders to resolve conflicting requirements. Use the STAR method to explain how you closed control gaps, drove remediation, and maintained stakeholder alignment.

Mentoring and Scaling a High-Performing Security Team

What to coverShare an example of how you built, mentored, and coached a technical validation or security architecture team through significant capability expansions. Detail the situation, your specific leadership actions in resolving team friction or balancing workloads, and the resulting team performance outcomes.

Enforcing Security Compliance Under Tight Project Deadlines

What to coverRecount a high-pressure scenario where a business unit wanted to push an AI or cloud solution into production before complete security control validation was finished. Outline the situation, your approach to risk evaluation, and how you ensured proper remediation without stalling business delivery.

Sharpen your knowledge

Topics to prepare

AI Security Frameworks and Risk Management
Review core AI security standards including NIST AI RMF, ISO/IEC 42001, OWASP Top 10 for LLMs, and MITRE ATLAS. Exercise: Map a hypothetical enterprise generative AI deployment against NIST AI RMF functions (Govern, Map, Measure, Manage) to identify potential model poisoning and prompt injection risks. Relevance: Directly aligns with the required understanding of AI security risks and control frameworks.
Cloud Security Reference Architectures
Study enterprise security reference architectures across multi-cloud environments (AWS, Azure, GCP, OCI) and on-premises setups. Exercise: Design a zero-trust network micro-segmentation strategy that incorporates cloud security posture management and pre-production control validation. Relevance: Matches the requirement for hands-on experience validating security controls against a reference architecture.
Identity and Access Management (IAM) and TPRM
Examine advanced IAM controls including privileged access, least-privilege principles, non-human/machine identities, and AI-agent identities, alongside Third-Party Risk Management (TPRM). Exercise: Conduct a mock third-party vendor go-live security assessment focusing on SaaS and AI-vendor supply-chain assurance. Relevance: Directly supports responsibilities regarding IAM and TPRM control validations.
AI-TRiSM Principles and Lifecycle Governance
Explore AI Trust, Risk, and Security Management concepts such as model provenance, data lineage tagging, guardrails, and continuous monitoring. Exercise: Draft an enterprise assurance lifecycle policy that integrates model red-teaming and continuous controls monitoring (CCM). Relevance: Directly fulfills the requirement to embed AI-TRiSM principles into control assurance.

Skills to revise

Pre-Production Security Control Evaluation
Develop and refine workflows for independent validation of platform, infrastructure, and application security controls prior to production. Exercise: Create a structured checklist and validation playbook for evaluating cloud-native applications against enterprise security policies and KRIs. Relevance: Aligns with the core duty of owning independent control validation across implementations.
AI Vulnerability Mitigation and Testing
Practice identifying and validating controls against prompt injection, model inversion, data leakage, and adversarial attacks. Exercise: Build a test plan using MITRE ATLAS techniques to evaluate an LLM application for prompt injection vulnerabilities. Relevance: Directly supports establishing the AI Security Validation capability.
Security Leadership and Cross-Functional Governance
Sharpen stakeholder management, team coaching, and metrics governance skills for security architecture practices. Exercise: Outline a framework for defining Key Risk Indicators (KRIs) and Service Level Objectives (SLOs) to report validation deliverables to C-suite leadership. Relevance: Matches the leadership expectations for directing a high-performing validation team and collaborating with enterprise architects.

Your preparation checklist

Compile Evidence of Security Architecture and Go-Live Validation Experience
Gather documentation, architectural review frameworks, and case studies demonstrating your 6+ years of hands-on experience in security control evaluation, go-live gatekeeping, and aligning implementations with reference architectures across cloud and on-prem environments.
Document Leadership and Team Mentorship Track Record
Prepare a summary of your 5+ years of experience leading, mentoring, and coaching high-performing cybersecurity validation teams, including examples of cross-functional conflict resolution, performance metric tracking, and stakeholder management.
Build an AI Security Framework Mapping Reference
Create a structured mapping document connecting NIST AI RMF, ISO/IEC 42001, OWASP Top 10 for LLMs, and MITRE ATLAS to practical validation workflows for LLMs, Generative AI, and agentic AI systems.
Draft a Control Validation Playbook for Cloud and Zero-Trust
Develop a sample security control evaluation playbook that covers multi-cloud environments (AWS, Azure, GCP, OCI), zero-trust network micro-segmentation, Identity & Access Management (IAM), and Third-Party Risk Management (TPRM).
Prepare Professional Certification and Credential Documentation
Organize your active CISM certification credentials alongside supporting evidence for preferred certifications such as CISSP, CCSP, Azure security badges, or ISO/IEC 42001 lead auditor training.
Formulate Targeted Questions for the CISO Tower Leadership
Prepare thoughtful questions regarding Cognizant's CAR practice priorities, how AI-TRiSM principles are currently embedded into their development lifecycle, and expectations for scaling the AI security validation function.

Availability has not yet been verified. Status can change after a check; confirm on the employer’s website. Report an issue · Our checking policy

KEEP EXPLORING

Similar AI jobs

Related skills and specializations in India. Matched to this role, not your profile.

Explore more jobs

Finding similar opportunities…