Director, Security Architecture

Cardinal Health

4d•$154,400 - $261,250

About The Position

The Director, Security Architecture establishes, leads, and develops security architecture strategy, standards, and design practices to enable secure, scalable, and resilient technology solutions across Cardinal Health. Reporting to the Vice President, Information Security & Risk, this technical leader aligns security architecture with business priorities, risk management objectives, and enterprise GTBS strategies. The role leads architecture strategy and governance, technical security standards, solution design and advisory, architecture reviews, and security tooling optimization. It embeds security into the development lifecycle, guides technology investments, and ensures security requirements are integrated into enterprise architectures and solutions from inception through deployment. The Director also leads a security architecture team and directs cybersecurity strategy and integration across the mergers and acquisitions lifecycle. The position provides leadership to managers and experienced professional staff, manages an organizational budget, develops policies and procedures, contributes to functional strategy, and makes decisions with extended impact on work processes, outcomes, and customers. It interacts with senior leaders and influences agreement in sensitive situations while maintaining positive relationships.

Requirements

10+ years of experience in cybersecurity, security architecture, or information security, with a focus on enterprise architecture and solution design preferred.
Deep expertise in security architecture frameworks, secure design principles, and enterprise technology environments.
Strong understanding of cybersecurity frameworks such as NIST CSF and ISO 27001, and of regulatory requirements.
Experience leading architecture reviews, defining standards, and guiding secure solution development.
Demonstrated ability to collaborate with cross-functional teams and influence technical and business stakeholders.
Strong leadership, communication, and problem-solving skills.
Experience in a leadership role overseeing security architecture or engineering teams.

Nice To Haves

Experience in highly regulated industries such as aviation, financial services, healthcare, or government.
Advanced degree such as an MBA, MS in Cybersecurity, Information Systems, or a related field.
Professional certifications such as CISSP, CCSP, SABSA, or TOGAF.
Experience with cloud security architecture, DevSecOps, and modern application development practices.

Responsibilities

Develop and lead the enterprise security architecture strategy aligned with cybersecurity, risk management, and business objectives.
Establish governance frameworks and processes to guide secure design, technology selection, and solution deployment.
Collaborate with cybersecurity leadership, enterprise architecture, and technology teams to define target-state architecture and long-term roadmaps.
Advise leadership on security architecture priorities, risks, and investment decisions.
Develop, maintain, and enforce enterprise security architecture standards, design principles, control requirements, and implementation guidelines.
Align security standards with regulatory requirements, industry frameworks, and organizational risk tolerance; govern their adoption across global teams and refine them as threats, technologies, and business needs evolve.
Oversee architecture reviews to evaluate solutions and system designs against security standards, risk requirements, and enterprise architecture.
Ensure security risks are identified, documented, and addressed before implementation; validate architecture decisions and oversee exception handling and risk acceptance processes.
Provide proactive, risk-informed security guidance during solution design and development, including security-by-design reviews and pre-implementation assessments.
Partner with application, engineering, and commercial technology teams to embed security requirements early in the development lifecycle.
Translate security requirements and risks for technical and non-technical stakeholders.
Assess, rationalize, and optimize cybersecurity tools to reduce complexity and redundancy and improve capability coverage.
Ensure tools align with enterprise security architecture and integrate with the broader cybersecurity ecosystem; continuously improve tooling strategy for scalability, efficiency, and innovation.
Define and support reference architectures, design patterns, and reusable security solutions.
Guide implementation of security controls within applications, infrastructure, and platforms, balancing security with performance, scalability, and usability.
Promote secure-by-design principles across development and engineering teams.
Assess current and target security capabilities, map them to business priorities and risk requirements, and develop a phased roadmap for investment and capability maturity.
Align architecture initiatives with enterprise transformation and emerging technology trends; provide visibility into capability gaps and investment priorities.
Collaborate with enterprise architecture, IT, engineering, risk, compliance, BISOs, and business stakeholders to align security architecture with enterprise, business, and technology initiatives.
Build and lead a high-performing security architecture team across cloud, application, infrastructure, and data security; develop team capabilities through coaching, training, and career development.
Foster technical excellence, innovation, and continuous improvement, and align team capabilities with evolving cybersecurity and business needs.
Maintain a standardized cybersecurity and infrastructure playbook for M&A due diligence, integration planning, and execution.
Oversee objectives, scope, roles, and processes for risk-aligned CISO program engagement in acquisitions and divestitures.
Lead integration planning to align cybersecurity and infrastructure priorities with deal objectives and coordinate integration of people, processes, and technologies.
Coordinate between acquired entities and enterprise CISO program teams, and oversee identification, assessment, and mitigation of security and infrastructure risks throughout the M&A lifecycle.
Manage an organizational budget and develop and implement policies and procedures to achieve organizational goals.