Director, Security Architecture

Northern Trust•Chicago, IL

2d•$164,600 - $288,000

About The Position

The Director, Security Architecture is a senior technical leader and enterprise security architecture decision authority who guides and makes security architecture decisions across complex, high-risk, and cross-domain technology initiatives. The Director provides authoritative security direction when existing standards, reference architectures, or patterns do not yield a clear answer, evaluating technology risk and design trade-offs while balancing security, business objectives, regulatory expectations, and enterprise technology strategy. This is a hands-on technical leadership and decision-authority role, not primarily a governance or people-management position. The Director makes independent enterprise-level architecture decisions within delegated authority, explains the rationale and risk trade-offs, and escalates matters that exceed that authority or require formal risk acceptance. The Director may lead a small team of Security Architects, delegating routine and established-pattern work while retaining responsibility for significant, novel, or cross-domain decisions. The role also develops the Security Architecture function’s capabilities and helps Northern Trust make faster, clearer, consistent, and defensible decisions. This includes improving decision rights, creating reusable security patterns and guardrails, strengthening architects’ judgment and technical depth, and helping evolve Security Authority and Architecture Review Board processes toward a scalable, increasingly automated operating model.

Requirements

12+ years of experience in cybersecurity, security architecture, engineering, enterprise architecture, or related technology disciplines.
Significant experience designing and evaluating security architectures within large, complex enterprises, preferably regulated enterprises.
Demonstrated ability to make and defend consequential technical and security architecture decisions.
Broad security expertise across multiple domains rather than specialization in a single technology or control area.
Strong knowledge of Zero Trust, defense in depth, least privilege, identity-centric security, segmentation, cloud security, application security, data protection, and privileged access.
Working knowledge of industry frameworks and standards such as the NIST Cybersecurity Framework, NIST SP 800-53, CIS Controls, and Zero Trust Architecture principles.
Experience translating architecture decisions into standards, reference architectures, reusable patterns, engineering guardrails, and technical requirements.
Ability to operate effectively across engineering, enterprise architecture, cybersecurity, risk, audit, and business organizations.
Strong executive communication skills, including translating complex technology and security considerations into clear risk, business, and decision language.
Demonstrated ability to lead, mentor, and develop architects and other senior technical professionals.
Must be authorized to work in the U.S. without employment-based visa sponsorship now or in the future.

Nice To Haves

Experience designing and evaluating security architectures in regulated enterprises.

Responsibilities

Serve as a delegated security architecture decision authority for complex, material, or cross-domain technology initiatives.
Make and document clear, defensible architecture decisions, including required controls, design changes, conditions, or escalation when risk exceeds delegated authority.
Lead resolution of complex security architecture issues spanning identity and access management, cloud, infrastructure, application security, data security, network security, privileged access, AI, and emerging technology.
Provide senior technical leadership to Security Authority and Architecture Review Board processes, driving clear and timely decisions without unnecessary governance overhead.
Establish and evolve security architecture principles, reference architectures, standards, guardrails, and reusable patterns.
Identify opportunities to translate repeatable architecture decisions and controls into automated guardrails and engineering patterns.
Challenge proposed technology designs when necessary and partner with engineering, architecture, technology, risk, and business leaders to develop secure, pragmatic alternatives.
Translate emerging technologies, threats, and regulatory expectations into actionable enterprise security architecture direction.
Lead and develop Security Architects, delegating routine and established-pattern work based on complexity, risk, and appropriate decision authority.
Mentor architects and strengthen architecture judgment, technical depth, and consistency across the Security Architecture function.
Represent Security Architecture with senior technology, risk, audit, business, and regulatory stakeholders on significant architecture and security matters.
Exercise independent technical judgment and make enterprise-level security architecture decisions within delegated authority.
Clearly articulate decision rationales and risk trade-offs, and escalate matters that exceed established authority or require formal risk acceptance.
Develop architecture capability within the team so architects can independently handle established patterns and lower-complexity decisions.