Senior Security Architect

Black Duck Software, Inc. helps organizations build secure, high-quality software, minimizing risks while maximizing speed and productivity. Black Duck, a recognized pioneer in application security, provides SAST, SCA, and DAST solutions that enable teams to quickly find and fix vulnerabilities and defects in proprietary code, open source components, and application behavior. With a combination of industry-leading tools, services, and expertise, only Black Duck helps organizations maximize security and quality in DevSecOps and throughout the software development life cycle. Job Title: Sr Security Architect Reports to (Direct Title): Sr. Manager, Threat Intelligence Department: Cybersecurity Operations Position Summary This role secures the multi-cloud infrastructure behind Black Duck's SaaS platforms. The Sr Security Architect will work on cloud security controls from design to operation: maintaining the baseline, finding where the environment departs from it, and working with engineering and platform teams until the risk is closed. The role is hands-on in the tooling and in the code, and automates anything done more than twice. This role works with broad autonomy and carries project-level technical leadership. The role leads cloud security projects or parts of larger initiatives, act as a technical resource for less experienced team members, and communicates risk clearly to technical teams and management. Essential Functions/Responsibilities Contribute to and maintain Black Duck's cloud security baseline: standards, guardrails, and reference configurations for GCP, Azure, and AWS, written so engineering teams can actually apply them. Design, build, and operate preventive and detective controls for SaaS workloads, including identity and access (IAM, workload identity, service accounts), network segmentation, encryption and key management, secrets handling, and logging coverage. Operate, tune, and enhance the cloud-native application protection platform (Wiz or comparable CNAPP): onboarding cloud accounts and Kubernetes clusters, writing and tuning policies and custom controls, cutting noise, and maturing coverage from agentless scanning to runtime sensors. Triage posture, vulnerability, and identity findings by real exposure and exploitability, not by raw severity, then partner with resource owners to prioritize and complete remediation, tracked against policy SLAs. Conduct security reviews and provide recommendations for new cloud services, architectures, and third-party integrations, using threat modeling and proofs of concept, before they reach production. Secure containerized and Kubernetes platforms (GKE, AKS, EKS): cluster hardening, RBAC, admission control and policy as code, image provenance, and runtime protection. Build security into CI/CD and infrastructure-as-code workflows (IaC scanning, image scanning, secrets detection, policy gates) so issues are caught before deployment rather than found in production. Contribute to software supply chain integrity for build and deployment pipelines, consistent with Black Duck's position as a software supply chain security company. Develop and maintain cloud detections from audit logs, control-plane events, and CNAPP signals; validate that the telemetry they depend on is actually collected. Support the CSIRT on cloud incidents: scoping, containment, evidence preservation, cloud forensics, and remediation, including post-incident hardening. Automate controls, enrichment, and remediation workflows using Python, Bash, cloud APIs, and infrastructure as code (Terraform, Helm). Lead defined cloud security projects and contribute to workstreams within complex cross-functional initiatives across engineering, platform, IT, and vendor partners. Provide technical guidance to less experienced team members, participate in peer reviews, and share cloud security best practices. Communicate cloud security risks and recommended actions to technical teams and management, supporting senior-level …

View the full posting and apply