[Hiring] Principal Cybersecurity Architect @IS3

Role Description

Looking for a Principal Cybersecurity Architect to own the enterprise security architecture across identity, access management, and Zero Trust. This is a senior individual contributor role with significant influence over how people, machines, and workloads authenticate, authorize, and access resources across our environment.

Responsibilities

• Partner with IT, infrastructure, and business stakeholders to integrate security into technology decisions.
• Mentor and guide security engineers on architecture standards and design decisions.
• Zero Trust Architecture
  • Design and mature a Zero Trust architecture (ZTNA, MFA, PAM) spanning identity, device trust, network access, and application security — grounded in NIST SP 800-207 and BeyondCorp principles.
  • Define reference architectures, security patterns, and guardrails consumed across engineering and infrastructure teams.
  • Lead threat modeling and security architecture reviews for major platform changes and initiatives.
  • Evaluate and select security tooling (SASE, SSE, ZTNA, NDR, EDR) aligned to the overall architecture strategy.
  • Drive continuous improvement of Zero Trust posture through gap assessments and maturity modelling.
• Identity & Access Management (IAM)
  • Own the enterprise IAM architecture — covering workforce identity, B2B federation, machine identities, and cloud entitlements.
  • Design and govern identity lifecycle management: provisioning, role assignment, access reviews, and deprovisioning — ensuring least privilege is enforced by default and not by exception.
  • Architect federation and SSO standards across the enterprise: SAML 2.0, OIDC, OAuth 2.0 — including integrations with third-party SaaS, partner tenants, and customer-facing portals.
  • Define authentication assurance levels by resource sensitivity, aligning MFA requirements to NIST AAL2/AAL3 — with a clear roadmap toward phishing-resistant MFA (FIDO2/WebAuthn) for privileged and high-risk access.
  • Lead the PAM architecture — credential vaulting, just-in-time privilege, session recording, and endpoint privilege management — in partnership with the security operations team.
  • Govern cloud entitlements across AWS, Azure, and GCP through a CIEM framework: identify over-permissioned roles, enforce least privilege for service principals and IAM roles, and manage cross-account trust relationships.
  • Establish and maintain a non-human identity strategy: service accounts, API keys, application credentials, and pipeline secrets — eliminating hardcoded credentials and enforcing dynamic secrets via a secrets management platform.
  • Drive identity governance processes: access certification campaigns, segregation of duties (SoD) controls, and role-based access control (RBAC) model design.
  • Partner with HR, IT, and business application owners to ensure joiner/mover/leaver processes are automated and auditable.
• Governance & Stakeholder Engagement
  • Define security architecture standards, policies, and exception management processes.
  • Mentor security engineers and serve as the escalation point for complex identity and access design decisions.
  • Produce architecture artefacts — threat models, data flow diagrams, trust zone maps — suitable for both technical and executive audiences.
  • Contribute to the security roadmap and annual planning, translating risk priorities into architectural investments.

Qualifications

• 8+ years in information security, with 4+ years in an architecture or senior engineering role.
• Deep expertise in Zero Trust frameworks (NIST SP 800-207, BeyondCorp) and identity-centric security.
• Strong understanding of threat modeling methodologies (STRIDE, PASTA, Telecommunication&CK).
• Hands-on experience with enterprise IAM platforms — Microsoft Entra ID, Okta, Ping Identity, or equivalent.
• Strong grasp of federation protocols: SAML 2.0, OIDC, OAuth 2.0, SCIM.
• Experience with PAM platforms (CyberArk, BeyondTrust, Delinea) and secrets management (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault).
• Familiarity with CIEM tooling and cloud IAM governance across at least two major cloud platforms.
• Experience designing and governing identity lifecycle and IGA processes (SailPoint, Saviynt, or equivalent a plus).
• Strong understanding of threat modelling methodologies (STRIDE, Telecommunication&CK) and their application to identity attack surfaces.
• Excellent communication skills — able to translate complex architecture into clear guidance for engineers, business stakeholders, and executives.
• Proven experience using diplomacy skills.

Certifications (preferred)

• CISSP
• SABSA
• TOGAF
• Microsoft SC-100
• Okta Certified Architect