The Senior Cloud Information Security Architect ensures the security of enterprise IT assets and information. This role is accountable for defining cloud security policy, analyzing and developing requirements, assessing the security of systems, and driving the overall cloud security posture.
Scope & Complexity
- This position supports cloud security activities for the company and its subsidiaries.
- This position requires the application of interpersonal skills with the ability to foster and grow business relationships, and to communicate at all levels of the organization. It requires a deep technical, architectural understanding of all facets of information security, including:
- Application Development Security Life Cycle,
- Threat Modeling,
- Infrastructure Security Controls,
- Compliance (e.g. PCI, SOX, NIST, ISO),
- Identity Management,
- Prevalent cloud services, such as AWS and Azure.
- Drives the definition and implementation of the cloud security model and architecture standards.
- Integrates security requirements into technology lifecycle management and contributes to multiple large, complex application projects with cross-functional teams and business users.
- Serves as the security expert in providing solution designs and technical consulting services in support of maintaining compliance with all applicable requirements including industry best practice, internal policy, the Payment Card Industry Data Security Standard, state data privacy laws, and ISO 27001 controls.
- Guides Security and Infrastructure Engineers through the research and advocacy of new technologies, architectures, and products that support security requirements for the enterprise and its customers, business partners, and vendors.
- Develops requirements, along with business, application development, and infrastructure partners, to drive the engineering processes that produce secure solutions.
- Is a thought leader who effectively communicates with and influences peers and leadership regarding optimum architectural approaches to meet business requirements, while managing security risk and maintaining compliance.
- Analyzes and recommends strategy and direction to mitigate security risks within the organization.
- Acts as a change agent through hands-on technical leadership.
- Demonstrates creative thinking and innovation with pragmatic outcomes that build constructive business relationships and gain the trust of others.
- Mentors, coaches, and trains members of the Information Security team, the broader Information Technology Services team, and other technologists throughout AAG.
- Drives continuous process and technology improvements.
- A minimum of 10 years of IT experience and 5 years of Information Security experience.
- A minimum of 3 years of experience (5 years is preferred), serving in a Security Architect position.
- A minimum of 3 years of experience supporting a technically diverse Cardholder Data Environment (CDE). Cloud Security experience (AWS and Azure), including both IaaS and PaaS models.
- Working knowledge of one or more security and IT Architecture standards, including COBIT, TOGAF, Open Security Architecture, or Service Oriented Modeling Framework.
- Demonstrated experience in the following areas: cloud, firewalls, intrusion detection & prevention, perimeter appliances, domain segmentation, filtering (virus, spam, etc.), network segmentation, authentication, enterprise portals, portal based access managers, database encryption, data encryption, host intrusion detection, enterprise directories (LDAP and Active Directory), and meta-directories.
- Demonstrated knowledge of Service Oriented Architectures and Web Services standards as they relate to an enterprise security model.
- Minimum age of 18
- Must be authorized to work in the U.S.
- Industry certification in security (e.g. CISA, CISSP, and/or GIAC).
- Strong PCI DSS knowledge and experience.
- Ability to lead, build and develop team of senior IT professionals through formal and informal reporting relationships.
- Proven experience in developing and executing plans, meeting deadlines, and operating under tight time constraints; monitoring trends in information technology, identity & access, and security that could have an impact on the security of the organization’s products, processes, infrastructure, or customers.
- Demonstrated ability to influence and clearly communicate across vast sections of IT and the business, including company leaders.
- Demonstrated experience in making articulate and effective verbal and written presentations to different audiences.
- Excellent organizational and leadership skills.
- Demonstrated business acumen.
- Excellent clear and concise verbal and written communication skills.
Job-Specific Leadership Expectations
- Embody our values to own safety, do the right thing, be kind-hearted, deliver performance, and be remarkable.
- High school diploma or equivalent is required.
- Bachelor of Science degree in computer science, systems engineering, information technology, management information systems, a related discipline, is preferred.