Enterprise Security Architect

Booz Allen Hamilton•McLean, VA

1d•$112,800 - $257,000

About The Position

Booz Allen is seeking a lead Enterprise Security Architect to support the growth, delivery, and continuous evolution of its threat detection and response capability. The role combines technical cybersecurity expertise with communication and commercial leadership to advise complex organizations, lead multidisciplinary teams, shape target-state capabilities, and deliver measurable improvements in detection and response. The successful candidate will bring broad cybersecurity experience and depth in detection engineering, endpoint security, security telemetry, log pipelining, data ingestion, and ETL. They will translate client challenges into practical architectures, operating models, roadmaps, and implementation plans; serve as a subject matter expert in proposals and client pursuits; and apply sound AI principles to detection and response challenges with appropriate security, governance, and human oversight. The architect will execute capability priorities and delivery standards, build reusable methods and reference materials, lead or oversee engagements, assess current-state capabilities and define target states, and support implementation and executive communications. They will also coach practitioners and consultants, facilitate cross-functional stakeholder sessions, and evaluate applications of AI, machine learning, generative AI, and agentic capabilities across detection and response. The position’s compensation range is $112,800 to $257,000 annualized USD. Booz Allen describes benefits that include health, life, disability, financial, and retirement benefits, paid leave, professional development, tuition assistance, work-life programs, dependent care, and recognition awards. The role’s specific work location type is not stated; the posting explains general expectations for remote, hybrid, and onsite roles. Candidates are expected to complete identity verification using biometrics and AI and to be on camera during interviews and assessments. Use of AI or other tools to assist with interview responses is prohibited unless explicitly permitted.

Requirements

10+ years of experience in architecture and transformation, including current-state assessment, target-state architecture, integration patterns, cloud and hybrid environments, operating models, roadmaps, implementation governance, or adoption and change.
10+ years of experience leading consulting engagements, technical workstreams, or cybersecurity transformation programs for complex organizations.
10+ years of experience turning ambiguous problems into practical capabilities, repeatable methods, and measurable delivery results.
5+ years of experience in threat detection and response, including detection strategy, use-case engineering, threat hunting, incident response, case management, SOC operating models, SOAR, XDR/SIEM, or metrics and continuous improvement.
5+ years of experience in detection engineering, including detection lifecycle, detection-as-code, analytic logic, rule development, testing and validation, tuning, content governance, ATT&CK-informed coverage, or engineering workflows.
5+ years of experience in endpoint and identity, including EDR/XDR, endpoint telemetry, endpoint controls, identity-aware detection, privileged access, containment and remediation workflows, or endpoint response constraints.
5+ years of experience in telemetry and data engineering, including logging strategy, source onboarding, log pipelines, routing and forwarding, streaming and batch patterns, ingestion, normalization, enrichment, data quality, ETL, or evidence resilience.
2+ years of experience in AI for cybersecurity, including AI/ML fundamentals, generative AI, retrieval and grounding, agentic workflows, evaluation, prompt and model risk, human-in-the-loop design, or responsible automation.
Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, or Engineering.

Nice To Haves

10+ years of experience in a professional services, systems integration, advisory, or consulting environment.
5+ years of experience responding to RFPs and developing client-ready solutions, estimates, delivery plans, and executive presentations.
5+ years of experience with major security platforms such as Microsoft Sentinel or Defender, Splunk, CrowdStrike, Google Chronicle, Elastic, QRadar, or comparable technologies.
2+ years of experience with cloud platforms, data platforms, event streaming, security orchestration, infrastructure-as-code, or software engineering practices.
CISSP, GIAC, SABSA, TOGAF, CCSP, Cloud Security, or vendor-specific security certifications.

Responsibilities

Execute the vision, priorities, and delivery standards for the threat detection and response capability, aligned with client risk, business outcomes, and market needs.
Build and maintain reusable methods, reference architectures, playbooks, accelerators, and points of view across detection engineering, endpoint security, telemetry, and response.
Coach and develop cybersecurity practitioners, technical leads, and emerging consultants, fostering technical rigor, practical delivery, and clear communication.
Lead or oversee cybersecurity engagements from problem definition through architecture, roadmap, implementation support, and executive readout.
Assess current-state detection and response capabilities and define target states that improve visibility, triage, investigation, response, resilience, and measurable outcomes.
Design and review detection engineering approaches, including use-case development, content lifecycle management, detection-as-code, testing, tuning, threat-informed coverage, and operational handoff.
Develop approaches for endpoint security, XDR/SIEM integration, telemetry strategy, log routing, streaming, ingestion, data quality, pipeline resilience, and ETL or data transformation.
Translate complex technical issues into concise recommendations for executives, business leaders, security practitioners, and engineering teams.
Facilitate workshops and working sessions with cybersecurity, IT, cloud, application, identity, network, data, operations, and business stakeholders.
Identify and apply AI, machine learning, generative AI, and agentic capabilities to improve detection, triage, investigation, threat hunting, engineering productivity, and response execution.
Serve as a trusted subject matter expert in proposals and client pursuits, translating client problems into practical architectures, operating models, roadmaps, and implementation plans.