Job Description:Job Title: Security ArchitectType of Work: Full-time
Location: United States (Remote)
Reports to: Senior Manager, Governance, Risk & Compliance (GRC)
We are seeking a Security Architect to join our Governance, Risk & Compliance (GRC) team. This role is the technical bridge between security, compliance, and engineering. The Security Architect will design and review security architectures for our SaaS and on-premises products and our corporate environment, translate regulatory and framework requirements into practical technical controls, and serve as the technical authority on architecture risk decisions. The ideal candidate combines deep hands-on technical expertise with a strong understanding of risk management and compliance.
Responsibilities - Security Architecture Design and Review: Design, document, and review security architectures for Kaleris products, public cloud environments, and corporate infrastructure. Establish reference architectures and secure design patterns that engineering teams can reuse.
- Threat Modeling and Architecture Risk Assessment: Lead threat modeling for new products, significant changes, and third-party integrations. Document findings and remediation in the risk register and contribute to the annual information security risk assessment.
- Control Design and Compliance Alignment: Translate requirements from ISO/IEC 27001:2022, SOC 2, NIST frameworks, and the EU Cyber Resilience Act (CRA) into technical control designs. Partner with GRC to produce control narratives and evidence that withstand external audit.
- Identity and Access Architecture: Define architecture standards for identity, privileged access, and access governance across SSO applications, cloud infrastructure, and Microsoft Entra ID.
- Third-Party and Integration Security: Review the architecture of vendor solutions, customer integrations, and external access models. Provide technical input to third-party risk management, customer contract security requirements, and customer security questionnaires.
- Resilience and Recovery Architecture: Partner with Infrastructure and Product teams to design for availability, backup integrity, and disaster recovery, and validate that recovery architectures meet defined RTO and RPO targets.
- Security Standards and Technical Policies: Author and maintain technical security standards (for example, encryption, logging, network segmentation, secure configuration, and data retention) that implement the Kaleris ISMS policies.
- Technology Evaluation: Evaluate and recommend security technologies, including cloud security posture, vulnerability management, and data protection tools, based on risk reduction and business value.
- Secure Development Partnership: Work with Product Security and Engineering to embed security requirements into the software development lifecycle, including security and governance requirements for AI-enabled features.
- Incident Response Support: Provide architectural expertise to Security Operations during incidents and post-incident reviews, and drive architecture-level remediation of root causes.
- Stakeholder Communication: Explain architecture risk clearly to engineers, executives, auditors, and customers, and support enterprise risk reporting to leadership.
Requirements - Experience: 8+ years in information security, including at least 5 years in a security architecture or security engineering role. Experience at a SaaS or enterprise software company is strongly preferred.
- Technical Expertise: Strong working knowledge of cloud security (AWS and/or Azure), identity and access management (Microsoft Entra ID, SSO, privileged access), network security, encryption and key management, logging and monitoring, and application security.
- Frameworks and Compliance: Practical experience mapping technical controls to ISO/IEC 27001, SOC 2, and NIST frameworks. Familiarity with the EU Cyber Resilience Act, NIS2, or secure-by-design requirements is a plus.
- Risk Management: Demonstrated ability to perform threat modeling (for example, STRIDE) and architecture risk assessments, and to communicate residual risk in business terms.
- Professional Certifications: One or more preferred: CISSP, CCSP, CISSP-ISSAP, SABSA, or a cloud security certification (for example, AWS Certified Security Specialty or Microsoft Certified: Azure Security Engineer Associate). CISM or CISA is a plus.
- Education: Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent practical experience.
- Communication Skills: Excellent interpersonal and written communication skills, with the ability to convey complex security concepts to technical and non-technical audiences.
- Analytical Skills: Strong analytical and problem-solving skills, with the ability to assess security risks and design effective, practical solutions.
The duties and responsibilities described are not a comprehensive list, and additional tasks may be assigned from time to time, or the scope of the position may change as necessary to meet business demands.
