Cybersecurity Architect

NextEra Energy•Juno Beach, FL

About The Position

Florida Power & Light Company is seeking a Cybersecurity Architect to augment its Cybersecurity Architecture team and assess cybersecurity risk associated with new technology implementations across a large, complex enterprise. This is a highly technical architecture and risk assessment role covering technologies such as cloud, SaaS, enterprise applications, infrastructure, networks, identity, APIs, AI/GenAI, OT/ICS, third-party solutions, and other emerging technologies. The work spans the technology lifecycle, from early planning and solution design through architecture review, implementation support, and pre-production validation. The role approaches cybersecurity as a business enabler, not as an approval gate. The architect identifies and communicates risks, defines appropriate controls and mitigations, and collaborates with project teams and vendors to find practical ways to meet business objectives securely. When risks cannot or will not be mitigated, the architect documents the residual risk for an informed risk-acceptance decision by the appropriate Business Unit Director. The successful candidate will independently manage complex and concurrent assessments, produce clear and defensible risk documentation, recommend proportionate mitigations, and build productive relationships with stakeholders. The role also contributes to reusable architecture patterns and standards, mentors cybersecurity professionals, and incorporates relevant threat and technology trends into architecture guidance.

Requirements

Demonstrated senior-level experience in cybersecurity architecture, solution security, or technology risk assessments in large, complex enterprise environments.
Strong understanding of cybersecurity architecture principles and their application across diverse technology environments.
Working knowledge of cloud security architecture, including IAM, networking, data protection, workload security, logging and monitoring, encryption, and shared-responsibility models in AWS, Azure, and/or GCP.
Working knowledge of network and infrastructure security, including segmentation, firewalls, WAFs, proxies, DNS, load balancers, certificates, encryption, remote access, and secure connectivity.
Working knowledge of application security, including authentication and authorization, APIs, web application security, secrets management, secure design patterns, OWASP risks, and third-party integrations.
Working knowledge of identity and access management, including SSO, federation, MFA, RBAC, privileged access, service and workload identities, and least privilege.
Knowledge of data security and privacy architecture, including data classification, encryption, key management, tokenization, DLP, and protection of sensitive and regulated information throughout its lifecycle.
Demonstrated ability to perform threat modeling and identify attack surfaces, trust boundaries, realistic threats, and potential attack paths.
Ability to interpret vulnerability assessments, penetration-test findings, and vendor security assessments and determine their relevance to architecture risk.
Experience evaluating third-party or vendor technologies and challenging unsupported or insufficient vendor security assertions.
Working knowledge of NIST CSF, NIST SP 800-53, NERC CIP, and ISO/IEC 27001.
Broad working knowledge of regulatory and compliance considerations, and judgment to recognize when legal, privacy, compliance, or regulatory expertise is needed.
Ability to independently lead architecture review meetings and drive technical discussions toward a clear risk determination.
Ability to manage multiple concurrent assessments in a high-volume, fast-paced environment.
Strong analytical, critical-thinking, and problem-solving skills.
Strong written communication skills, especially the ability to develop concise and defensible cybersecurity risk statements.
Strong interpersonal skills and ability to build productive relationships with application and project teams and third-party vendors.
Ability to translate technical cybersecurity concerns into practical mitigation requirements.
Ability to work independently with minimal supervision, identify missing information, ask appropriate technical questions, and drive assessments to completion.

Nice To Haves

Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Engineering, or a related discipline; equivalent relevant professional experience will be considered.
Certifications such as CISSP, CCSP, or comparable cybersecurity, cloud, or architecture certifications.
Experience performing cybersecurity architecture assessments in a Fortune 500 or similarly large, complex enterprise.
Experience with multiple cloud environments, including AWS, Microsoft Azure, and Google Cloud Platform.
Familiarity with OT/ICS cybersecurity and the security and operational considerations of critical infrastructure, including safety, availability, reliability, and regulatory constraints.
General awareness of emerging AI/GenAI security risks and considerations.
Experience contributing to cybersecurity reference architectures, reusable security patterns, technical standards, or architecture guidance.
Experience in a utility, critical infrastructure, or other highly regulated environment.

Responsibilities

Lead cybersecurity architecture reviews for complex projects, platforms, applications, infrastructure, cloud services, SaaS platforms, vendor solutions, APIs, and enterprise integrations.
Analyze solution architectures, network and data flows, trust boundaries, authentication models, integrations, external connectivity, and security controls.
Perform threat modeling to identify realistic threat scenarios, attack paths, trust-boundary concerns, and potential security weaknesses.
Identify cybersecurity risks and assign appropriate ratings using enterprise risk methodologies and professional judgment.
Explain the technical and business implications of identified cybersecurity risks.
Define required and recommended security controls and practical mitigation strategies.
Produce concise, defensible risk documentation covering exposure, potential impact, risk rating, mitigation requirements, and residual risk.
Document residual risks requiring Business Unit Director acceptance when appropriate mitigations will not be implemented.
Assess internet-facing technologies and external attack surfaces, including applications, APIs, exposed services, authentication, WAFs, DDoS protections, DNS, certificates, ingress architectures, and external connectivity.
Assess cloud architectures, including IAM, networking, workload security, logging and monitoring, data protection, encryption, and shared-responsibility models.
Evaluate application security architecture, including authentication and authorization, APIs, web application security, secrets management, encryption, secure patterns, OWASP risks, and third-party integrations.
Evaluate identity and access management architectures, including SSO, federation, MFA, RBAC, privileged access, service and workload identities, and least privilege.
Evaluate data security and privacy across data classification, collection, storage, processing, transmission, encryption, access controls, retention, and third-party handling of sensitive or regulated information.
Assess cybersecurity resiliency, including single points of failure, backup and recovery dependencies, ransomware resilience, and the operational impact of security controls.
Review vendor security architectures and supporting evidence, including security assessments, penetration-test results, vulnerability scans, and architecture documentation.
Recognize regulatory, privacy, and compliance implications, including NERC CIP, and engage subject-matter experts when specialized expertise is needed.
Develop reusable cybersecurity architecture patterns, reference architectures, standards, and implementation guidance for recurring risks or patterns.
Facilitate architecture review sessions with application teams, project teams, technical stakeholders, and third-party vendors.
Guide migration and modernization strategies and coordinate with domain specialists on novel or high-risk technical decisions.
Mentor cybersecurity professionals and improve review methods, templates, and architecture quality.
Monitor industry threats and technology trends and incorporate relevant improvements into architecture standards and patterns.
Manage a high volume of concurrent assessments independently while maintaining quality and meeting review timelines.