Lead Cybersecurity Architect

JPMorganChase•Jersey City, NJ

About The Position

As a Lead Cybersecurity Architect within JPMorganChase’s Cybersecurity and Technology Controls line of business, you will help shape cybersecurity solutions across complex enterprise technologies. You will identify and communicate cybersecurity risk, define practical mitigation strategies, influence target-state architecture, and drive security outcomes across technology domains and business functions. The role focuses on securing enterprise Collaboration & Communication technologies, including cloud platforms, SaaS services, Microsoft 365, technology integrations, and AI-enabled capabilities. You will work with engineering, product, architecture, risk, and business teams to shape cybersecurity strategy, conduct threat modeling, assess control effectiveness, establish secure and reusable architecture patterns, and support secure adoption of modern technologies. You will also provide technical leadership, contribute to firmwide security practices, and use enterprise-authorized AI capabilities in security workflows while validating results and following data-sensitivity requirements.

Requirements

Formal training or certification in cybersecurity architecture and at least 5 years of applied experience.
Hands-on practical experience delivering enterprise-level cybersecurity architecture, solutions, and security controls across complex technology environments.
Demonstrated experience leading complex cybersecurity architecture initiatives and influencing technical decisions across engineering, product, architecture, risk, and business teams.
Advanced expertise in one or more programming languages and/or applications, with advanced cybersecurity architecture and technical-process knowledge in one or more disciplines such as public cloud, SaaS, AI/ML, application security, or enterprise collaboration technologies.
Hands-on experience conducting and leading threat modeling, attack-surface analysis, security architecture assessments, and security design reviews.
Ability to identify threats, control gaps, and cybersecurity risks and define scalable mitigation strategies, security patterns, and target-state solutions.
Strong understanding of modern cloud security concepts, including identity and access management, authentication and authorization, application and API security, data protection, logging and monitoring, external connectivity, and trust boundaries.
Ability to evaluate current and emerging technologies and define or influence future-state cybersecurity architecture and security strategy.
Ability to interpret complex architecture diagrams and data flows, evaluate control effectiveness, and communicate cybersecurity risks and recommendations to engineering, product, architecture, risk, and senior leadership stakeholders.
Ability to independently lead complex design, architecture, and security problems with minimal oversight and drive issues toward resolution.
Proficiency in automation, continuous delivery methods, and Software Development Life Cycle practices, with an understanding of Continuous Integration/Delivery, application resiliency, and security.
Demonstrated experience using enterprise-authorized AI capabilities to support cybersecurity architecture workflows, with strong validation practices and awareness of data sensitivity.
Ability to assess and validate AI-assisted security recommendations before adoption, escalate uncertainty, and ensure outcomes align with security, resiliency, traceability, and auditability expectations.

Nice To Haves

Experience securing enterprise cloud and SaaS environments, including assessing architecture, data flows, identity, access, integrations, and security controls across third-party services.
Security architecture experience across AWS, GCP, and Microsoft Azure, including understanding cloud-native security controls and shared responsibility models.
Experience evaluating SaaS integrations, APIs, OAuth applications, service principals, application identities, and machine-to-machine authentication from a security and risk perspective.
Experience with Microsoft 365 security architecture, including Exchange Online, Microsoft Teams, SharePoint Online, OneDrive, Microsoft Entra ID, Microsoft Graph, Microsoft Purview, Microsoft Defender, and Microsoft Copilot.
Experience securing AI/ML and LLM-enabled applications, agents, and emerging AI capabilities, including risks involving data access, permissions, external integrations, third-party model dependencies, and agentic architectures.
Experience developing and driving adoption of security control baselines, architecture standards, threat models, assessment frameworks, and reusable security patterns across cloud and SaaS technologies.
Familiarity with security frameworks and methodologies such as NIST, MITRE ATT&CK, STRIDE, OWASP, and zero-trust principles.
Experience providing technical leadership across complex, cross-functional cybersecurity initiatives involving multiple technology or business organizations.
Experience communicating complex cybersecurity architecture, risk, and technical recommendations effectively to senior technology and business leaders.
Knowledge of financial services technology environments and cybersecurity, resiliency, and risk considerations associated with operating at enterprise scale.

Responsibilities

Define and influence cybersecurity architecture strategy and target-state security patterns across enterprise Collaboration & Communication technologies, cloud platforms, SaaS services, Microsoft 365, AI-enabled capabilities, and strategic technology integrations.
Engage technical teams and senior business stakeholders to evaluate and recommend technical approaches that address current and future cybersecurity needs.
Lead cybersecurity architecture and design reviews for complex and strategic technology initiatives, identifying threats, attack paths, control gaps, and risks and driving mitigation strategies.
Lead threat modeling, attack-surface analysis, and security architecture assessments across applications, platforms, integrations, and emerging technologies.
Evaluate risks associated with third-party integrations, APIs, application permissions, authentication and authorization patterns, data flows, external connectivity, and trust boundaries.
Assess existing security controls and define practical mitigation strategies, compensating controls, reusable security patterns, and control baselines where threats are not sufficiently mitigated.
Lead evaluation sessions with external vendors, technology providers, and internal teams to assess cybersecurity architecture, technical capabilities, security controls, and applicability within the firm’s technology environment.
Partner with engineering, product, architecture, and risk teams to turn cybersecurity findings into actionable remediation plans and drive complex issues toward resolution or appropriate risk escalation.
Identify opportunities to eliminate, automate, or prevent recurring cybersecurity issues through scalable controls, reusable architecture patterns, tooling, and security-by-design practices.
Provide technical leadership and direction across teams and serve as a function-wide subject matter expert for complex cybersecurity architecture decisions.
Lead and contribute to communities of practice that advance cybersecurity architecture standards, frameworks, tools, reusable patterns, and adoption of emerging security technologies.
Advocate for firmwide frameworks, tools, and Software Development Life Cycle practices within the engineering community.
Use enterprise-authorized AI capabilities to accelerate cybersecurity risk analysis, architecture assessment, and control validation, validating outputs and handling data according to sensitivity and security requirements.
Drive reuse-first adoption of AI-assisted security validation in SDLC and security toolchain processes to improve control testing, remediation quality, traceability, auditability, and resiliency.