Cybersecurity Architect

We are the Global Shared Services Centre for a major client RGE (Royal Golden Eagle), one of the world’s largest resource-based manufacturing groups with diversified business in Pulp and Paper, Palm Oil (upstream & downstream), Viscose Fiber, FMCG, Energy, and other business segments. As Cybersecurity Architect, you will be the authority on securing the Group’s rapidly expanding cloud footprint across AWS, and hybrid environments. You will define cloud security architecture, standards, and reference patterns that protect enterprise workloads, data, and identities as the organization migrates SAP S/4HANA (RISE), M365, infrastructure, and business applications to the cloud. This is a hands-on architectural role bridging cybersecurity strategy with cloud engineering execution.

Key Responsibilities

Provide the overall technical direction for cybersecurity strategy and architecture, across a hybrid on-premise and cloud landscape.

Design and maintain the Group’s cloud security reference architecture across AWS and hybrid environments, covering landing zones, network security, identity, data protection, and workload security.

Define cloud security standards, guardrails, and policies aligned with frameworks such as NIST CSF, CIS Benchmarks, ISO 27001, and CSA Cloud Controls Matrix; ensure adoption across all cloud deployments.

Architect identity and access management (IAM) solutions for hybrid environments including Entra ID, conditional access, privileged identity management (PIM), and zero-trust architecture principles.

Lead cloud security posture management (CSPM) strategy using tools such as Microsoft Defender for Cloud, AWS Security Hub, or third-party CSPM platforms; drive continuous compliance monitoring and remediation.

Design secure network architectures for cloud: micro-segmentation, WAF, DDoS protection, private endpoints, service endpoints, and hybrid connectivity security (ExpressRoute / Direct Connect / VPN).

Provide security architecture guidance for SAP RISE / S/4HANA cloud migration, M365 tenant hardening, and cloud-native application development (containers, serverless, API security).

Develop an AI agentic-first security review and vulnerability management pipeline to strengthen our security posture while enabling automation.

Define and operationalize cloud security monitoring, detection, and response capabilities, integrating cloud logs and alerts into the Group’s SIEM/SOAR platform.

Collaborate with Infrastructure/Network Ops on secure cloud landing zone deployment, IaC security (Terraform, ARM), and DevSecOps pipeline integration (SAST, DAST, SCA).

Provide technical leadership on cloud data protection: encryption at rest and in transit, key management (AWS KMS), DLP policies, and data classification enforcement.

Stay current with emerging cloud threats, vulnerabilities, and attack techniques; advise leadership on evolving risk posture and recommend mitigation strategies.

Qualifications & Requirements

Bachelor’s degree in Computer Science, Cybersecurity, Information Security, or related field; Master’s degree is an advantage.

Minimum 8–12 years in cybersecurity with at least 4 years focused on cloud security architecture across AWS, or multi-cloud environments.

Deep hands-on expertise in AWS security services.

Strong knowledge of zero-trust architecture, identity-centric security models, PAM/PIM, and modern authentication protocols (OAuth 2.0, SAML, OpenID Connect).

Practical experience with cloud-native security tooling: CSPM, CWPP, CNAPP, CASB, and cloud DLP solutions.

Familiarity with securing SAP cloud environments (SAP RISE, BTP) and M365 security & compliance features (Purview, Defender for Office 365).

Strong understanding of IaC security (Terraform, CloudFormation), container security (Kubernetes, Docker), and DevSecOps practices.

Preferred Qualifications

CISSP, CCSP, CCAK, or SABSA certification; AWS Certified Security – Specialty.

Experience with regulatory compliance in multi-jurisdiction environments (PDPA, GDPR, SOX, industry-specific regulations).

Background in securing OT/IT convergence environments or multi-industry conglomerates (manufacturing, plantations, FMCG, oil & gas).

Experience with SIEM/SOAR platforms and threat intelligence integration.