Security Architect

Description

Job Summary: Design, evaluate, and implement secure technology architectures, integrating security controls into DevSecOps environments and ensuring compliance with corporate and regulatory security standards. Key Highlights: 1. Lead security in DevSecOps environments and secure architectures. 2. Promote security by design throughout the software development lifecycle. 3. Ensure compliance with security standards and regulations. **Credicorp Capital** invites you to Turn Challenges into Opportunities and become our next **Security Architect** on the **DevSecOps** team in **Lima, Peru**. **Mission:** Design, evaluate, and support the implementation of secure technology architectures, with emphasis on integrating security controls into DevSecOps environments, ensuring that IT solutions comply with corporate information security standards, the ISMS, and applicable regulatory frameworks (including DORA), aligned with the organization's risk appetite. Act as a liaison between business, technology, development teams, and security teams, promoting adoption of security-by-design practices and security across the software development lifecycle (Secure SDLC). **Responsibilities:** * Design secure architectures integrated into DevOps environments and CI/CD platforms. * Develop guidelines and validate security controls in CI/CD pipelines (SAST, DAST, SCA); support adoption of security tools such as GitHub Advanced Security (GHAS). * Assess risks across the software development chain and DevOps pipelines. * Ensure compliance with ISMS, security standards, and regulations (including DORA). * Define secure development guidelines, secret management, and infrastructure-as-code practices. * Evaluate technology architectures including AI and cloud. **Requirements:** * Professionals holding degrees in Systems Engineering, Computer Science, Software Engineering, Electronics, or related fields. * Specialization in Information Security and/or Cybersecurity (mandatory). * Minimum 4 years of experience implementing cybersecurity technologies and 2 years in DevSecOps. * Proven experience in: + Implementing security controls in DevOps / DevSecOps environments + Integrating security tools into CI/CD pipelines + Participating in secure development initiatives from a cybersecurity perspective + Integrating security controls: SAST, DAST, SCA + GitHub Advanced Security (GHAS) + Cloud security (primarily Azure) * Knowledge of: + ISMS and technological risk management + Security audits and regulatory compliance * Frameworks and standards: + Understanding of DORA as applied to technological risk and resilience + ISO 27001 / ISO 27017 / ISO 27018, NIST, PCI-DSS, Zero Trust * Complementary knowledge: + APIs, microservices + Infrastructure-as-code (IaC) + Data security and encryption + Fundamentals of artificial intelligence and associated risks + Ethical Hacking (conceptual) + Secure development + Automation of security controls * Regular interaction with technical teams and business units. **Desired Technical Knowledge:** * Cloud security (AWS, GCP). * Application, API, microservice, and data security. * Ethical Hacking and hardening (conceptual). * Security applied to artificial intelligence architectures and data platforms. * Security in cloud platforms and distributed architectures. ***This posting is open to persons with disabilities.***