Director, Security Architecture

Role Summary

The Director, Security Architecture is a senior technical leader and enterprise security architecture decision authority responsible for guiding and making security architecture decisions across complex, high-risk, and cross-domain technology initiatives.

This role provides authoritative security direction when established standards, reference architectures, or patterns do not provide a clear answer. The Director evaluates technology risk and design trade-offs, resolves complex architecture issues, and ensures decisions appropriately balance security, business objectives, regulatory expectations, and enterprise technology strategy.

The Director may lead a small team of Security Architects responsible for lower-complexity architecture assessments exception management, established-pattern reviews and reference architecture libraries, and other delegated architecture activities, while maintaining direct responsibility for significant, novel, or cross-domain architecture decisions.

Key Responsibilities

• Serve as a delegated security architecture decision authority for complex, material, or cross-domain technology initiatives.
• Make and document clear, defensible architecture decisions, including required controls, design changes, conditions, or escalation when risk exceeds delegated authority.
• Lead resolution of complex security architecture issues spanning identity and access management, cloud, infrastructure, application security, data security, network security, privileged access, AI, and emerging technology.
• Provide senior technical leadership to Security Authority and Architecture Review Board processes, driving clear and timely decisions without adding unnecessary governance overhead.
• Establish and evolve security architecture principles, reference architectures, standards, guardrails, and reusable patterns that enable consistent and scalable security decisions.
• Identify opportunities to translate repeatable architecture decisions and controls into automated guardrails and engineering patterns.
• Challenge proposed technology designs when necessary and partner with engineering, architecture, technology, risk, and business leaders to develop secure and pragmatic alternatives.
• Translate emerging technologies, threats, and regulatory expectations into actionable enterprise security architecture direction.
• Lead and develop Security Architects, delegating routine and established-pattern work based on complexity, risk, and appropriate decision authority.
• Mentor architects and strengthen architecture judgment, technical depth, and consistency across the broader Security Architecture function.
• Represent Security Architecture with senior technology, risk, audit, business, and regulatory stakeholders on significant architecture and security matters.

Leadership and Decision Authority

This is a hands-on technical leadership and decision-authority role, not primarily a governance or people-management position.

The Director is expected to exercise independent technical judgment, make enterprise-level security architecture decisions within delegated authority, clearly articulate the rationale and risk trade-offs behind those decisions, and escalate matters when they exceed established authority or require formal risk acceptance.

The Director is also expected to develop architecture capability within the team, enabling architects to independently handle established patterns and lower-complexity decisions while preserving senior decision capacity for the organizations most significant architecture challenges.

Qualifications

• 12+ years of experience in cybersecurity, security architecture, engineering, enterprise architecture, or related technology disciplines.
• Significant experience designing and evaluating security architectures within large, complex, and preferably regulated enterprises.
• Demonstrated ability to make and defend consequential technical and security architecture decisions.
• Broad security expertise across multiple domains rather than specialization in a single technology or control area.
• Strong knowledge of Zero Trust, defense in depth, least privilege, identity-centric security, segmentation, cloud security, application security, data protection, and privileged access.
• Working knowledge of industry frameworks and standards such as the NIST Cybersecurity Framework, NIST SP 800-53, CIS Controls, and Zero Trust Architecture principles.
• Experience translating architecture decisions into standards, reference architectures, reusable patterns, engineering guardrails, and technical requirements.
• Ability to operate effectively across engineering, enterprise architecture, cybersecurity, risk, audit, and business organizations.
• Strong executive communication skills, including the ability to translate complex technology and security considerations into clear risk, business, and decision language.
• Demonstrated ability to lead, mentor, and develop architects and other senior technical professionals.

What Success Looks Like

Success in this role means Northern Trust can make faster, clearer, consistent, and defensible security architecture decisions without unnecessarily escalating routine technical matters.

The Director increases the organizations ability to resolve complex architecture questions, establishes clearer decision rights, develops reusable security patterns and guardrails, strengthens the architecture teams capabilities, and helps evolve Security Authority and ARB toward a more scalable and increasingly automated architecture operating model.

Salary Range:

Salary range is a good faith estimate of base pay. Northern Trust provides a comprehensive benefits package including retirement benefits (401k and pension), health and welfare benefits (medical, dental, vision, spending accounts and disability), paid time off, parental and caregiver leave, life & accident insurance, and other voluntary and well-being benefits. Northern Trust also provides a discretionary bonus program that may include an equity component.

Work Authorization

Applicants must be authorized to work in the U.S. without the need for employment-based visa sponsorship now or in the future. Northern Trust will not sponsor applicants for U.S. work visa status for this opportunity (no sponsorship is available for H-1B, L-1, TN, O-1, E-3, H-1B1, F-1, J-1, OPT, CPT or any other employment-based visa).