The Security Architect is responsible for designing, developing, and maintaining security architectures that protect client systems, applications, networks, identities, and data. This role bridges strategic security planning with hands-on technical execution by translating business, security, and compliance requirements into secure, scalable technical solutions. The Security Architect partners closely with engineering, IT, infrastructure, and business teams to evaluate risks, implement security controls, and ensure security best practices are embedded throughout the technology environment.
Key Responsibilities
- Design and document secure architectures for networks, cloud environments (AWS/Azure/GCP), applications, and identity systems across client environments.
- Define and maintain security architecture standards, reference architectures, and design patterns across the organization.
- Review new projects, systems, applications, and vendor solutions to evaluate security architecture alignment and provide risk-based recommendations to engineering and business teams.
- Lead threat modeling exercises for new applications, infrastructure changes, migrations, and major technology initiatives.
- Design and validate identity security architectures, including identity governance, access management, privileged access controls, authentication strategies, and Zero Trust implementations.
- Evaluate identity-related risks and recommend improvements across Active Directory, Entra ID, IAM/PAM platforms, and cloud identity environments.
- Design and implement identity and access management (IAM), network segmentation, encryption, and Zero Trust strategies.
- Evaluate and recommend security tooling (SIEM, EDR, DLP, CASB, WAF, IAM/PAM, etc.) and oversee integration into the broader security architecture.
- Partner with DevOps and Platform teams to embed security into CI/CD pipelines and infrastructure-as-code (DevSecOps) practices.
- Support incident response and forensic activities by providing architectural context, root cause analysis support, and remediation recommendations.
- Ensure security architectures align with applicable compliance frameworks (SOC 2, ISO 27001, NIST CSF, PCI DSS, HIPAA, etc.) based on business requirements.
- Mentor engineers and junior security team members on secure design principles and architecture best practices.
- Maintain current architecture diagrams, data flow diagrams, security documentation, and technical standards.
- Stay current on emerging threats, attacker techniques, identity security trends, and evolving security technologies.
Required Qualifications
- 7-10+ years of experience in information security, including at least 2-3 years in a security architecture-focused role.
- Deep understanding of network security, cloud security architecture, identity security, IAM/PAM, and application security principles.
- Hands-on experience with at least one major cloud provider (AWS, Azure, or GCP) and its native security services.
- Experience designing and evaluating identity security solutions, including identity governance, authentication, authorization, privileged access, and Zero Trust strategies.
- Familiarity with security frameworks and standards including NIST CSF, ISO 27001, CIS Controls, and MITRE ATT&CK.
- Experience with threat modeling methodologies such as STRIDE or PASTA.
- Strong scripting and automation skills (Python, Terraform, or similar) are a plus.
- Excellent written and verbal communication skills, with the ability to explain technical risks and recommendations to both technical and non-technical stakeholders.
- Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent professional experience.
Preferred Qualifications
- Relevant certifications: CISSP, SABSA, CCSP, GIAC (GSEC/GCIA/GDSA), AWS Security, or Azure Security certifications.
- Experience working in regulated industries such as finance, healthcare, or government contracting.
- Experience designing, implementing, or maturing Zero Trust architectures.
- Prior experience leading security design reviews, architecture assessments, or Architecture Review Board activities.
- Experience with identity security platforms, including Microsoft Entra ID, Active Directory, IAM, or PAM solutions.
