HPC Security Architect

Stony Brook University•Stony Brook, NY

12d•Hybrid

About The Position

The HPC Security Architect leads the design, implementation, and governance of security architecture across Stony Brook University's advanced research computing ecosystem, including AMA27, SeaWulf, NVWulf, and ClinWulf. The role establishes a risk-based security framework to support compliance with HIPAA, NIST 800-171, NIH Genomic Data Sharing (GDS) Policy, federal export control requirements, and emerging AI governance standards. The incumbent partners with the Division of Information Technology, Stony Brook Medicine IT, Research Security, IRB, faculty, and other stakeholders to embed secure-by-design principles across compute, storage, data workflows, and collaborative research environments. The architect defines secure reference architectures and segmentation strategies for computing, storage, and high-speed networking; advances zero trust principles; and aligns HPC security with institutional and SUNY-wide initiatives. The role also develops compliant research computing patterns, System Security Plans, identity and access controls, data protection and governance workflows, threat models, risk assessments, and incident response playbooks. It provides security guidance for Linux-based HPC systems, container platforms, schedulers, GPU systems, AI pipelines, storage, networking, and research cloud integrations. The position supports secure research collaboration and data sharing, advises faculty on secure research design and grant proposals, and develops security training for researchers and technical staff. Other duties and projects may be assigned as appropriate to the rank and area mission. This is a full-time, FLSA-exempt appointment. The position is approved for SUNY's hybrid telecommuting pilot, allowing up to five remote days per pay period. The university is unable to sponsor work visas for this position.

Requirements

Bachelor's degree, or a combination of directly related full-time cybersecurity experience and experience in research computing or large-scale distributed systems totaling nine years may be considered in lieu of a degree.
Five years of experience in cybersecurity, with experience in research computing or large-scale distributed systems.
Experience with NIST 800-171 or regulated data environments.
Experience with identity and access management architectures.
Experience with network and system security design.
Experience with Linux systems.
Experience translating complex regulatory requirements into technical implementations.
Ability to communicate effectively with others.

Nice To Haves

Advanced degree (foreign equivalent or higher).
Experience supporting HPC environments or research infrastructure.
Experience with HIPAA.
Experience in AI/ML security, model governance, and data provenance.
Experience with high-performance networking and storage architectures.
Experience with federated identity (InCommon, SAML, OIDC) and research collaboration frameworks.
Certification in CISSP, CISM, CCSP, or similar.
Familiarity with Cumulus, Mellanox Onyx, or SONiC network operating systems.
Storage design, configuration, and benchmarking experience spanning high-speed flash, spinning disk, and archival solutions.

Responsibilities

Design and maintain multi-tier security architecture for SeaWulf, NVWulf, ClinWulf, and AMA27 research computing environments.
Define reference architectures for secure compute, storage, and high-speed networking, and establish network, identity, and workload-isolation strategies across research tiers.
Lead adoption of zero trust principles in HPC and research environments and align HPC security strategy with institutional and SUNY-wide initiatives.
Implement security controls aligned with HIPAA, NIST 800-171/CMMC, NIH GDS Policy, and federal export control requirements.
Partner with Research Security, Privacy, IRB, and Legal to define compliant research computing patterns and support Data Use Agreements.
Enable secure data acquisition, storage, and sharing workflows, and develop and maintain System Security Plans and supporting documentation for regulated environments.
Architect and enforce IAM integration, including federated access and MFA, and implement role-based and attribute-based access controls.
Define secure onboarding workflows for faculty, research staff, external collaborators, and federated or national computing environments.
Oversee data protection strategies, including encryption, key management, and secure data lifecycle controls.
Design and operationalize tiered secure research environments for open, restricted, and regulated data.
Collaborate with Data Brokerage and Honest Broker services to support privacy-preserving data access.
Define secure data pipelines for clinical, genomic, imaging, and large-scale AI/ML datasets.
Establish controls for secure collaboration and data sharing, including external access frameworks.
Conduct threat modeling for HPC and AI workloads, including supply-chain and model security risks, and lead risk assessments for research initiatives and infrastructure deployments.
Partner with enterprise security teams to integrate HPC into SOC monitoring, vulnerability management, and incident response processes.
Develop playbooks for research-specific incidents, such as data exfiltration and misuse of compute resources.
Provide security guidance for Linux-based HPC environments, container platforms, and scheduler systems.
Define secure configurations for GPU systems, AI pipelines, high-performance storage, and research cloud integrations.
Support high-speed networking design, including topology and switch configurations.
Develop and deliver security guidance and training for researchers and technical staff.
Advise faculty on secure research design and grant proposals, and contribute to letters of support and DMSP guidance related to secure computing environments.
Perform other duties and projects as assigned and appropriate to rank and area mission.