About the role
Security is most effective when it is built into how teams already work. Our clients need someone who can design identity systems, harden pipelines and get them audit-ready without grinding delivery to a halt.
You'll lead IAM and zero-trust programs, advise executives on risk, and work hands-on with engineers to implement the controls.
Your team
You'll work alongside cloud, engineering and compliance colleagues, with a dedicated security practice lead for support and review.
The impact you'll have
Least-privilege access
Clean joiner-mover-leaver flows and privileged access that auditors trust.
Shift-left security
Automated checks in the pipeline that catch issues before production.
Audit confidence
Evidence collected continuously, not scrambled for at the last minute.
What you'll do
- Design SSO, MFA and privileged access for workforce and customer identity
- Embed DevSecOps controls into delivery pipelines
- Prepare clients for SOC 2, ISO 27001 and HIPAA audits
- Run threat modeling and architecture security reviews
A typical week might include
- Workshop on privileged access with a client
- Reviewing pipeline security findings with engineers
- Mapping controls to SOC 2 criteria
- Briefing a CTO on top risks
Technical scope and expected depth
The areas this role may cover. The exact environment and priorities are agreed for each engagement.
Identity architecture
Assess workforce and workload identities, SSO, federation, MFA, lifecycle automation, and entitlement ownership. Define joiner, mover, and leaver workflows with auditable exceptions.
Privileged access
Review administrative access, service accounts, credentials, break-glass procedures, session controls, and periodic access review. Connect technical controls to accountable owners.
Cloud and application controls
Evaluate configuration, network boundaries, encryption, secrets, software delivery controls, vulnerability management, and security telemetry with engineering partners.
Risk and evidence
Document findings with business impact, supporting evidence, remediation options, owners, and priority. Maintain traceability between requirements, implemented controls, and residual risk.
Incident preparation
Create realistic response scenarios, escalation paths, communication plans, and recovery exercises. Test operational assumptions and convert lessons into assigned improvements.
Security governance
Build review routines, exception handling, control ownership, and leadership reporting that fit the organization’s actual capacity.
What you'll deliver
Risk point of view
A clear view of material risks, control gaps, exposure, owners, and the decisions that deserve attention first.
Identity roadmap
A sequenced path for workforce identity, privileged access, lifecycle automation, federation, and access governance.
Control operating model
Ownership, evidence paths, exception handling, metrics, and governance integrated into normal work.
Readiness playbook
Response, recovery, continuity, and tabletop practices tested against realistic scenarios and lessons learned.
What you bring
- 6+ years in security engineering or identity
- Hands-on Okta, Entra ID or equivalent
- Knowledge of NIST, SOC 2 or ISO 27001 frameworks
- Consulting or client-facing experience
Practical capabilities we will discuss
- Identity protocols and lifecycle
- Explain identity federation, authentication, authorization, provisioning, and session behavior. Discuss how lifecycle changes are reconciled across directories, applications, and privileged systems.
- Assessment quality
- Show how you validate a finding, distinguish a design issue from an implementation gap, and communicate residual risk. Recommendations should be specific enough for an accountable owner to act.
- Operational realism
- Discuss how a control behaves during a service outage, staff change, emergency access request, or third-party incident. Identify the evidence needed to know the control is working.
- Consulting evidence
- Bring a security or identity example that demonstrates assessment, stakeholder alignment, prioritization, implementation support, and follow-up. Use anonymized information where appropriate.
Nice to have
- CISSP, CISM or cloud security certifications
- Policy-as-code (OPA)
- Incident response experience
How success is assessed
Success criteria are agreed at the start of the engagement and reviewed as the work progresses. Typical signals include:
- Security leaders can distinguish material risk from an undifferentiated backlog.
- Control owners understand their responsibility, evidence, exceptions, and next action.
- Identity access is governed through a visible lifecycle rather than informal requests.
- Teams can respond to a plausible incident with practiced roles and decision paths.
- Security work becomes easier to explain to executives, customers, auditors, and engineering teams.
Your first 90 days
First 30 days
- Learn client environments and current control gaps
- Shadow an identity or compliance workstream
- Review our security delivery playbook
By day 60
- Lead a control-implementation workstream
- Run a threat-modeling session with a client team
- Draft an evidence-automation plan
By day 90
- Own a program-level roadmap for a client
- Present risk posture to executives
- Add to our internal control library
How we work with clients
- Prepare workshops with a clear decision, relevant evidence, and the people needed to act on the outcome.
- Document assumptions, alternatives, costs, dependencies, and risks so stakeholders can review your recommendation.
- Escalate delivery or quality concerns early with options and a recommended course of action.
- Protect confidential information and use approved collaboration and delivery environments.
- Transfer knowledge through pairing, practical documentation, and walkthroughs with the people taking ownership.
Tools you may use
- Okta
- Entra ID
- CyberArk / PAM
- Vault
- Snyk
- Wiz
- OPA
- Splunk
Interview process
- 01
Apply
Share your background. A human reads every application.
- 02
Intro call
30 minutes on your goals, experience and what you want next.
- 03
Technical conversation
A practical discussion with a practitioner — no trick puzzles.
- Scenario discussion. Talk through designing access for a fast-growing, regulated company.
- Threat-modeling exercise. Identify risks and controls for a sample architecture.
- 04
Team & terms
Meet the people you'd work with, then agree scope and terms in writing.
Location, engagement and compensation
This is an expression-of-interest profile for client work we are shaping. A confirmed vacancy, employment arrangement, travel requirements and compensation range have not yet been published. Before an approved role proceeds, we agree client context, availability, duration, compensation or rate and any benefits in writing.
Telugu Technologies is an equal opportunity employer. We consider all qualified applicants regardless of race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability or veteran status, and provide reasonable accommodations on request — email careers@telugutechnologies.com.