Identity Threat & Exposure (ITDR / ISPM) Service Architect

Atos is the Atos Group brand dedicated to AI-powered, secure, end-to-end digital services. Atos designs, develops, and operates critical digital environments that drive performance, resilience and sovereignty, helping public and private organizations worldwide retain control over their data and infrastructures, while meeting regulatory requirements.
With more than 52,000 employees serving over 4,500 clients across 54 countries, Atos helps modernize core IT systems, accelerate cloud and data transformation, strengthen cybersecurity, and deliver secure digital workplace environments to support its clients, its employees and society. Atos also provides consulting and advisory services through its Atos Amplify brand.
A trusted partner in operating complex and mission-critical environments, Atos supports organizations across highly regulated and sovereign contexts.
About Atos Group
Atos Group is a global leader in digital transformation with c. 54,000 employees and annual revenue of c. €7.2 billion, operating in 54 countries under two brands - Atos for services and Eviden for products and systems. European number one in cybersecurity and a leader in cloud, Atos Group is committed to a secure and decarbonized future and provides tailored AI-powered, end-to-end solutions for all industries. Atos Group is listed on Euronext Paris.
Must Have Skills
Architected and productised identity security services (reference architecture, platform evaluation and selection, service definition), not implementation only
Active Directory and Microsoft Entra ID security internals (Kerberos, ACLs, delegation, tiering, conditional access, token model); Okta an advantage
Identity attack techniques at reproduction depth, mapped to MITRE ATT&CK credential access, privilege escalation, lateral movement and persistence (Kerberoasting, pass-the-hash/ticket, DCSync, ADCS abuse, token theft and replay, MFA fatigue, OAuth and consent abuse), and the telemetry each leaves
Attack path analysis as a graph problem, including cloud role escalation (BloodHound, PingCastle, Purple Knight)
ITDR platforms hands-on with at least one of Microsoft Defender for Identity, CrowdStrike Falcon Identity Protection, Silverfort, Semperis, Vectra AI
ISPM platforms hands-on with at least one of Radiant Logic, Semperis, Veza, Tenable Identity Exposure, Silverfort
Detection engineering and behavioural baselining (Sentinel/KQL, Splunk, Sigma), with detection coverage mapped to MITRE ATT&CK and false-positive management
Response automation and containment design SOAR playbooks, API-level containment actions, containment authority model
Security operations fluency has introduced detection content or containment authority into a SOC and can hold the alert-quality conversation
Good to have
Threat hunting and deception design (honeytokens, decoy accounts)
Exposure management platforms (Tenable One, Microsoft Security Exposure Management, Wiz)
PAM platforms at API level (Idira/CyberArk, BeyondTrust) as signal and containment lever
NIS2 and DORA incident reporting obligations; GDPR constraints on behavioural monitoring
Work Location Mumbai & Bangalore
Here at Atos, diversity and inclusion are embedded in our DNA. Read more about our commitment to a fair work environment for all.
Atos is a recognized leader in its industry across Environment, Social and Governance (ESG) criteria. Find out more on our CSR commitment.
Choose your future. Choose Atos.

Work arrangement
No