Position OverviewThe Director of Security Architecture and Security Services sets the technical direction for the organization's security technology stack and the security guardrails that shape cloud adoption and application modernization. This leader partners with Technology, Engineering, and Infrastructure teams to ensure security tooling (EDR, DLP, and others) is selected, integrated, and evolved deliberately. They also make sure security is built into the way the business moves to the cloud and modernizes its applications.
This is a hands-on, strategic leadership role requiring a strong blend of technical expertise, business acumen, and influence. The ideal candidate will serve as a trusted technical advisor, partnering with engineering, product, and business leaders to translate security and technology risks into practical, scalable design and implementation decisions. In this role, the individual will be responsible for executing the following key responsibilities:
Security Technology Strategy and Advisory- Advise Technology leadership on the security tool stack, including endpoint detection and response (EDR), data loss prevention (DLP), identity and access management, email security, vulnerability management, SIEM/SOAR, and related platforms.
- Own the security technology roadmap and reference architecture, balancing coverage, integration, cost, and operational complexity.
- Lead vendor evaluations, proof-of-concept efforts, and build-vs-buy recommendations.
- Identify tooling gaps, overlaps, and consolidation opportunities, and make the business case for investment or rationalization.
Cloud Strategy and Application Modernization Guardrails- Partner with Cloud, Platform, and Engineering teams to define and recommend security guardrails for cloud adoption (multi-cloud or single-cloud), including landing zone design, network segmentation, identity, encryption, logging, and configuration standards.
- Embed security into application modernization efforts such as containerization, microservices, API strategy, serverless, and CI/CD pipelines.
- Establish patterns that allow teams to move fast safely: secure-by-default templates, policy-as-code, and paved-road architectures.
- Review and advise on architecture for high-impact initiatives, providing risk-based guidance rather than acting as a gatekeeper.
Architecture Governance and Risk- Define, publish, and maintain security architecture principles, standards, and reference patterns.
- Run the architecture review process, with clear criteria for when reviews are required and a focus on timely, actionable feedback.
- Translate threat models, regulatory requirements, and risk assessments into architectural requirements.
- Communicate architectural risks and tradeoffs clearly to technical and executive audiences, including the CISO and CIO.
Leadership and Collaboration- Build, lead, and develop a team of security architects.
- Serve as a trusted partner to CTO/CIO organizations, Engineering, Infrastructure, Data, and Compliance stakeholders.
- Collaborate with Security Operations, GRC, and Incident Response to ensure architecture supports detection, response, and audit readiness.
- Represent security architecture in steering committees, design authorities, and executive forums.
QualificationsRequired- 12+ years of experience in information security, with 5+ years in security architecture and 3+ years in a leadership role.
- Deep, hands-on knowledge of enterprise security technologies, including EDR/XDR, DLP, IAM/PAM, SIEM, CASB/SSE, and network and cloud security controls.
- Strong experience with cloud security in at least one major platform (AWS, Azure, or GCP) and with modern application architectures (containers, Kubernetes, APIs, DevSecOps).
- Proven ability to influence technology teams and executives without relying solely on authority.
- Working knowledge of security frameworks and standards such as NIST CSF, NIST 800-53, ISO 27001, CIS Benchmarks, SABSA, and Zero Trust principles.
- Excellent written and verbal communication, including the ability to present to executives and the board.
Preferred- Experience in [healthcare / financial services / other regulated industry] and familiarity with relevant regulations (e.g., HIPAA, PCI DSS, SOC 2).
- Experience with infrastructure-as-code, policy-as-code, and CSPM/CNAPP tooling.
- Background in a large-scale cloud migration or application modernization program.
- Relevant certifications such as CISSP, CCSP, CISM, SABSA, or cloud provider security certifications.
- Bachelor's degree in a technical field or equivalent experience; advanced degree a plus.
Please note at this time we are unable to proceed with candidates who require visa sponsorship now or in the future.Location and Workplace FlexibilityZelis is headquartered in the U.S., with multiple locations across the country and in Hyderabad, India. Check out our locations to learn more about our offices. All employee work locations are based on the needs of the position and are determined by the Leadership team. In-office work and activities vary based on work and team objectives in accordance with Company policies.
While location expectations vary by role, candidates within approximately 50 miles of a U.S. office are generally preferred to support collaboration when needed. Our hybrid approach is flexible, and in-office presence is guided by team and business needs rather than a fixed weekly schedule.
Base Salary Range$180,000.00 - $247,500.00
At Zelis we are committed to providing fair and equitable compensation packages. The base salary range allows us to make an offer that considers multiple individualized factors, including experience, education, qualifications, as well as job-related and industry-related knowledge and skills, etc. Base pay is just one part of our Total Rewards package, which may also include discretionary bonus plans, commissions, or other incentives depending on the role.
Zelis' full-time associates are eligible for a highly competitive benefits package as well, which demonstrates our commitment to our employees' health, well-being, and financial protection. The US-based benefits include a 401k plan with employer match, flexible paid time off, holidays, parental leaves, life and disability insurance, and health benefits including medical, dental, vision, and prescription drug coverage.
