Cybersecurity Architect

Grow your career with us

Here at Averis, our common purpose is to improve lives by developing resources sustainably. Our people are crucial in helping us to realise our vision to be one of the best Global Business Solution (GBS) organization to support our customers in creating value for the Community, Country, Climate, Customer and Company.

Responsibilities:

We are the Global Shared Services Centre for a major client RGE (Royal Golden Eagle), one of the world’s largest resource-based manufacturing groups with diversified business in Pulp and Paper, Palm Oil (upstream & downstream), Viscose Fiber, FMCG, Energy, and other business segments. As Cybersecurity Architect, you will be the authority on securing the Group’s rapidly expanding cloud footprint across AWS, and hybrid environments. You will define cloud security architecture, standards, and reference patterns that protect enterprise workloads, data, and identities as the organization migrates SAP S/4HANA (RISE), M365, infrastructure, and business applications to the cloud. This is a hands-on architectural role bridging cybersecurity strategy with cloud engineering execution.

Key Responsibilities

• Provide the overall technical direction for cybersecurity strategy and architecture, across a hybrid on-premise and cloud landscape.
• Design and maintain the Group’s cloud security reference architecture across AWS and hybrid environments, covering landing zones, network security, identity, data protection, and workload security.
• Define cloud security standards, guardrails, and policies aligned with frameworks such as NIST CSF, CIS Benchmarks, ISO 27001, and CSA Cloud Controls Matrix; ensure adoption across all cloud deployments.
• Architect identity and access management (IAM) solutions for hybrid environments including Entra ID, conditional access, privileged identity management (PIM), and zero-trust architecture principles.
• Lead cloud security posture management (CSPM) strategy using tools such as Microsoft Defender for Cloud, AWS Security Hub, or third-party CSPM platforms; drive continuous compliance monitoring and remediation.
• Design secure network architectures for cloud: micro-segmentation, WAF, DDoS protection, private endpoints, service endpoints, and hybrid connectivity security (ExpressRoute / Direct Connect / VPN).
• Provide security architecture guidance for SAP RISE / S/4HANA cloud migration, M365 tenant hardening, and cloud-native application development (containers, serverless, API security).
• Develop an AI agentic-first security review and vulnerability management pipeline to strengthen our security posture while enabling automation.
• Define and operationalize cloud security monitoring, detection, and response capabilities, integrating cloud logs and alerts into the Group’s SIEM/SOAR platform.
• Collaborate with Infrastructure/Network Ops on secure cloud landing zone deployment, IaC security (Terraform, ARM), and DevSecOps pipeline integration (SAST, DAST, SCA).
• Provide technical leadership on cloud data protection: encryption at rest and in transit, key management (AWS KMS), DLP policies, and data classification enforcement.
• Stay current with emerging cloud threats, vulnerabilities, and attack techniques; advise leadership on evolving risk posture and recommend mitigation strategies.

Qualifications & Requirements

• Bachelor’s degree in Computer Science, Cybersecurity, Information Security, or related field; Master’s degree is an advantage.
• Minimum 8–12 years in cybersecurity with at least 4 years focused on cloud security architecture across AWS, or multi-cloud environments.
• Deep hands-on expertise in AWS security services.
• Strong knowledge of zero-trust architecture, identity-centric security models, PAM/PIM, and modern authentication protocols (OAuth 2.0, SAML, OpenID Connect).
• Practical experience with cloud-native security tooling: CSPM, CWPP, CNAPP, CASB, and cloud DLP solutions.
• Familiarity with securing SAP cloud environments (SAP RISE, BTP) and M365 security & compliance features (Purview, Defender for Office 365).
• Strong understanding of IaC security (Terraform, CloudFormation), container security (Kubernetes, Docker), and DevSecOps practices.

Preferred Qualifications

• CISSP, CCSP, CCAK, or SABSA certification; AWS Certified Security – Specialty.
• Experience with regulatory compliance in multi-jurisdiction environments (PDPA, GDPR, SOX, industry-specific regulations).
• Background in securing OT/IT convergence environments or multi-industry conglomerates (manufacturing, plantations, FMCG, oil & gas).
• Experience with SIEM/SOAR platforms and threat intelligence integration.

When you send us your resume and personal details, it is deemed you have provided your consent for us to keep or store your information in our database. All the information you have provided is only used for the recruitment process. Averis will only collect, use, process or disclose personal information where and when allowed to under applicable laws.
Only shortlisted candidates will be contacted for an interview. We endeavour to respond to every applicant. However, if you receive no response from us within 60 days, please consider your application for this specific position unsuccessful. We may contact you in the future if there are opportunities that match your qualifications and experience. Thank you for considering a career with Averis.