IoT & Connected Devices Security Architect

Grainger Businesses•Lake Forest, IL

1d•$146,200 - $243,600•Remote

About The Position

The Information Security team protects Grainger’s systems and data across its global company, using cloud, on-premises, and SaaS platforms. The Security Architecture team serves as a strategic security design partner for Grainger’s technology systems. This role owns security architecture for Grainger’s IoT and connected devices, including KeepStock vending platforms at customer sites across North America, AI-enabled vending systems using edge computer vision, and supporting cloud, web, and identity services. The architect will establish consistent fleet security baselines and incorporate security into the multi-year product roadmap and rationalized platform set. The role combines IoT and embedded expertise with broad security architecture across cloud, web applications and APIs, identity, and endpoint security. It requires understanding customer environments, business priorities, and field operations to align stakeholders on risk, cost, reliability, and customer experience. This is a senior individual-contributor role reporting to the Director of Cybersecurity Architecture. The position may be based remotely or at Grainger’s offices in the Chicago area.

Requirements

Deep security architecture expertise in large-scale IoT, embedded, or edge systems, combined with broad enterprise architecture experience; ownership of strategy and target state rather than firmware or platform administration.
10+ years in information security or related engineering, including 8+ years in security architecture across multiple domains and at least 4 years focused on IoT, embedded, or edge systems.
Proven ability to align senior stakeholders behind multi-year direction and rationalize overlapping or acquired technology portfolios through capability mapping and migration strategy.
Strong experience with cloud-connected IoT and network architectures, including edge runtimes, MQTT, messaging authorization, segmentation from customer environments, and cellular, satellite, Wi-Fi, and wired connectivity.
Solid cloud, application, and identity architecture experience, including cloud IAM, web application firewalls, API gateways, secrets management, federation, MFA, and privileged access management.
Expert understanding of device trust and device-scale PKI, including hardware roots of trust (TPM, secure elements, HSMs), secure and measured boot, attestation, certificate rotation and revocation, and failure modes.
Experience hardening commercial and embedded operating systems to IoT security standards, including endpoint detection and response, vulnerability management, and secure OTA updates with signing and rollback protection.
Experience defining fleet security telemetry, containment, and recovery patterns, and turning incident findings into architecture improvements.
Working knowledge of edge computer vision security, including model protection, adversarial inputs, MLOps across edge and cloud, and privacy obligations for camera and sensor data.
Strong communication skills, including the ability to translate technical concepts for executives and defend architectural positions with evidence.

Nice To Haves

Experience in connected retail, industrial IoT, robotics, or comparable edge devices.
Certifications such as CISSP, CCSP, or relevant cloud, Linux, or industrial cybersecurity credentials.

Responsibilities

Own security architecture and posture across device fleets, edge platforms, and supporting cloud, web, and identity services; lead platform rationalization toward a consistent target state.
Partner with senior business, product, engineering, operations, and security stakeholders to align priorities, translate business context into security requirements, explain security risk in business terms, and provide actionable engineering direction.
Serve as the security design authority for connected systems in Grainger’s architecture governance process, engaging early to influence hardware, platform, and vendor decisions.
Lead security architecture for cloud platforms, web applications, and APIs that manage the fleet, including cloud IAM, web application firewalls, API protection, and secrets management, in partnership with domain architects.
Lead threat modeling across devices, edge platforms, connectivity, cloud services, web applications and APIs, and field workflows, including physical tampering, device cloning, and unattended operation.
Define measurable security baselines for field devices running commercial and embedded operating systems, tailored to device capability and risk, covering hardening, secure boot, disk encryption, and endpoint detection and response.
Establish secure delivery patterns for edge software and AI models, including signing, provenance, staged rollout, rollback, and software and model bills of materials.
Secure edge AI models and inference while balancing security, privacy, latency, cost, and customer experience in placement decisions.
Create device trust architectures covering unique identities, secure onboarding, PKI, certificate lifecycle, secrets protection, mutual authentication, and least-privilege device messaging.
Design identity and access patterns for devices, services, technicians, administrators, vendors, and customers, including federation, privileged access, and auditable device-specific authorization.
Architect secure connectivity across cellular, satellite, Wi-Fi, and wired deployments, including carrier strategy, failover, and isolation from customer networks.
Shape endpoint and fleet telemetry, vulnerability management, compromised-device containment, and recovery with engineering and security operations teams.
Communicate security posture to leadership through metrics and KPIs, and mentor peers and junior architects through design reviews.

Benefits

Medical, dental, vision, and life insurance coverage starting on day one of employment.
Six free sessions each year with a licensed therapist.
18 paid time off (PTO) days annually for full-time employees, prorated based on employment start date.
Six company holidays per year.
A 6% company contribution to a 401(k) Retirement Savings Plan each pay period, with no employee contribution required.
Employee discounts.
Tuition reimbursement.
Student loan refinancing.
Free access to financial counseling, education, and tools.
Maternity support programs and nursing benefits.
Up to 14 weeks of paid leave for birth parents and up to 4 weeks of paid leave for non-birth parents.
Incentive target of up to 20%, based on individual and company performance objectives.