Information Security Architect

AmTrust Financial Services, Inc.•Cleveland, OH

About The Position

The Information Security Architect designs, assesses, and advances security architecture across identity and access management, infrastructure, cloud, applications, data, networks, endpoints, third parties, and operational technology. As a member of the Security Architecture & Engineering team, the role partners with infrastructure, engineering, application development, and security leaders to inform and secure enterprise technology decisions. The architect leads architecture and design reviews, develops and governs security standards, embeds secure-by-design principles, evaluates emerging technologies, and designs scalable controls aligned with business objectives, regulatory requirements, and industry practices. The role also supports secure AI development and deployment, including guidance for generative AI, data protection, access governance, model risk management, responsible AI, and secure lifecycle controls. It contributes to enterprise security strategy and roadmaps, advises on complex initiatives, and helps build security architecture capabilities through mentorship and leadership. The position requires compliance with company policies, standards, and applicable regulatory requirements, including SOX IT General Controls, PCI DSS, GDPR, and CCPA. AmTrust offers a competitive compensation package, career advancement opportunities, and the benefits listed in the posting. The company describes its culture as diverse and inclusive.

Requirements

Bachelor’s degree in Cybersecurity, Computer Science, Computer Engineering, Information Technology, or a related field, or an equivalent combination of education and relevant work experience.
At least 5 years of progressive experience in Information Security, with demonstrated expertise designing, implementing, and governing enterprise security capabilities.
Broad architecture experience across cybersecurity, infrastructure, cloud, applications, data, identity, and enterprise technology domains.
At least 5 years leading enterprise-wide cybersecurity architecture strategy, governance programs, architecture roadmaps, or large-scale security transformation initiatives.
Ability to translate business objectives, regulatory requirements, and cyber risk considerations into scalable security architectures, standards, and strategic technology decisions.
Strong knowledge of security architecture principles and frameworks, including Zero Trust, defense-in-depth, secure-by-design, cloud security, identity and access management, data protection, and cyber resilience.
Excellent communication, stakeholder management, and leadership skills, including the ability to influence technology and business leaders across organizational levels.

Nice To Haves

Professional security and architecture certifications such as CISSP, CCSP, CISM, SABSA, TOGAF, AWS Security Specialty, Microsoft Azure Security Engineer Associate, or equivalent industry-recognized credentials.
Knowledge of cybersecurity architecture and control frameworks and standards, including NIST CSF, NIST SP 800-53, ISO 27001, CIS Critical Security Controls, SABSA, Zero Trust Architecture, Secure SDLC, threat modeling, and risk-based architectural decision-making.
Understanding of security architecture patterns across AWS, Azure, SaaS, IaaS, and PaaS, including microservices, APIs, IAM, PAM, encryption, key and secrets management, event-driven architectures, data protection, and security analytics.
Business and risk acumen, including knowledge of operating models, financial management, cost-benefit analysis, cyber risk quantification, and enterprise risk management; ability to define strategy, develop multi-year roadmaps, and govern current- and target-state architectures at enterprise scale.
Ability to assess threat trends, attack surface exposure, emerging technologies, and regulatory requirements and translate insights into executive-level position papers, recommendations, and investment priorities.
Success leading cross-functional cybersecurity, infrastructure, engineering, application development, cloud, data, risk, privacy, and compliance initiatives, and mentoring architects and engineers through coaching, collaboration, and delegation.
Recognized cybersecurity architecture leadership with a track record of influencing enterprise security strategy, reducing systemic cyber risk, enabling secure business transformation, and advising on cybersecurity investments and technology decisions.

Responsibilities

Lead development of the enterprise cybersecurity architecture vision and technology strategy, aligning business objectives, cyber risk priorities, and security capabilities through roadmaps, target-state architectures, and guiding principles.
Establish, review, and govern cybersecurity architecture across identity, infrastructure, cloud, applications, data, network, endpoint, third-party, and operational technology domains.
Advise on complex, high-risk, cross-functional initiatives; lead architecture governance and promote adherence to security standards, policies, roadmaps, and control requirements.
Develop, maintain, and promote enterprise security reference architectures, design patterns, control frameworks, and architecture standards.
Partner with AI governance and technology stakeholders to design cybersecurity processes and controls for secure development, deployment, and operation of AI-enabled solutions.
Define security architecture guidance for emerging technologies, including generative AI, addressing data protection, access governance, model risk management, responsible AI, and secure lifecycle controls.
Monitor threat intelligence, attack techniques, regulations, and technology trends to identify strategic risks, opportunities, and future security investment needs.
Ensure security, platform, and technology vendor selections align with enterprise architecture principles, cybersecurity strategy, risk appetite, and business objectives.
Embed security-by-design principles, including Zero Trust, least privilege, defense-in-depth, network segmentation, secure configuration, data protection, and cyber resilience.
Collaborate with security operations, risk management, infrastructure, engineering, application development, data, privacy, and compliance teams to support threat detection, incident response, disaster recovery, vulnerability management, and regulatory obligations.
Establish cybersecurity architecture quality standards for secure engineering, operational readiness, observability, resilience, and integrated response capabilities.
Strengthen security architecture capabilities through mentorship, knowledge sharing, and leadership, fostering a security-first culture.
Comply with company policies, standards, and regulatory requirements, including SOX IT General Controls, PCI DSS, GDPR, CCPA, and other applicable obligations.