Mainframe Security Architect

Kyndryl • Toronto, ON

7d • CA$138,320 - CA$188,320 • Hybrid

About The Position

Kyndryl is seeking a Mainframe Security Architect to lead the architecture and operationalization of mainframe security solutions for their managed-services clients. This role involves working with the mainframe consulting team to validate solutions, translating recommendations into practical managed-services designs, and providing architecture guidance across various IBM Z security domains. The architect will support client environments using RACF, ACF2, and Top Secret/TSS, design security patterns for key mainframe access paths and workloads, and support integration with enterprise security capabilities. The position also requires defining operating models for user enrollment, identity correlation, access reviews, and guiding delivery teams through the design and implementation process. The role involves creating reusable Kyndryl assets and engaging with client stakeholders to ensure proposed controls are secure, practical, auditable, resilient, and supportable under managed-services SLAs.

Requirements

• Strong experience with IBM Z / z/OS security architecture, engineering, or operations.
• Deep hands-on knowledge of at least one major mainframe External Security Manager: RACF, ACF2, or Top Secret/TSS.
• Working knowledge across mainframe security concepts, including SAF, ESM integration, dataset security, general resource protection, privileged access, started tasks, service accounts, digital certificates, SMF, audit controls, and security administration.
• 10 + years experience securing mainframe subsystems and access paths such as CICS, Db2, IMS, MQ, USS, FTP/SFTP, SSH, TSO, TN3270, batch, JES, and SDSF.
• Experience with mainframe MFA, enterprise IAM integration, identity lifecycle management, access certification, RBAC, least privilege, privileged access, and non-human identity governance.
• Experience integrating mainframe security with SIEM/SOC processes, including security event forwarding, alerting, monitoring, investigation, and audit reporting.
• Ability to design solutions that account for DR, high availability, fallback, exception handling, performance, password/passphrase policies, operational support, change management, and regulatory auditability.
• Experience in managed services, outsourcing, consulting, financial services, insurance, government, healthcare, or other regulated enterprise environments.
• Strong communication and documentation skills, including architecture diagrams, technical designs, implementation plans, runbooks, risk summaries, and executive-level updates.

Nice To Haves

• Experience with IBM Z MFA / zMFA, Broadcom Advanced Authentication Mainframe, Rocket MFA, or equivalent mainframe MFA capabilities.
• Familiarity with identity lifecycle intelligence and governance platforms such as SailPoint, IBM Security Identity Governance and Intelligence, IBM Verify Identity Governance, or equivalent client platforms.
• Experience with mainframe security, compliance, monitoring, and resilience tools such as IBM zSecure, Broadcom ACF2, Broadcom Top Secret, Broadcom Compliance Event Manager, Broadcom Trusted Access Manager for Z, BMC AMI Defender, Rocket Secure Host Access, Rocket z/Assure VAP, or equivalent tools.
• Knowledge of RACDC যুক্তি, ICSF, AT-TLS, TLS certificates, dataset encryption, key labels, CKDS/PKDS/TKDS concepts, certificate lifecycle management, and cryptographic controls.
• Experience with mainframe security assessments, audit remediation, CIS/STIG/NIST/SOX/PCI control alignment, pervasive encryption, quantum-safe encryption readiness, immutable copies, cyber vault, or cyber recovery.
• Working knowledge of JCL, REXX, CLIST, CARLa, TSO/ISPF, SDSF, JES2/JES3, SMF reporting, automation, ServiceNow, Ansible, or Git-based operational workflows.
• Bilingual English/French is an asset for Canadian client engagements.

Responsibilities

• Lead the architecture and operationalization of mainframe security solutions for Kyndryl managed-services clients.
• Work with the Kyndryl mainframe consulting team to validate solutions being designed, proposed, and recommended to clients.
• Translate consulting recommendations into practical managed-services designs, implementation approaches, runbooks, controls, support procedures, and operational readiness plans.
• Provide architecture guidance across IBM Z security domains, including authentication, authorization, privileged access, dataset and resource protection, audit, monitoring, encryption, compliance, and cyber resilience.
• Support client environments using RACF, ACF2, and Top Secret/TSS.
• Design and validate security patterns for key mainframe access paths and workloads, including TSO, TN3270, CICS, Db2, IMS, MQ, FTP/SFTP, SSH, USS, batch, JES, SDSF, started tasks, service IDs, vendor IDs, automation IDs, and privileged users.
• Support integration with enterprise security capabilities, including MFA, identity lifecycle intelligence and governance, privileged access management, SIEM/SOC monitoring, incident and change management, resilience, and compliance processes.
• Define practical operating models for user enrollment, identity correlation, access reviews, exception handling, break-glass access, fallback, DR, password/passphrase impacts, monitoring, alerting, reporting, and steady-state support.
• Guide delivery teams through design, build, test, pilot, cutover, stabilization, and transition-to-run.
• Create reusable Kyndryl assets such as reference architectures, discovery questionnaires, implementation checklists, SIEM mappings, exception models, test plans, runbooks, and operational readiness criteria.
• Engage with client security architects and technical stakeholders to confirm that proposed controls are secure, practical, auditable, resilient, and supportable under managed-services SLAs.

Benefits

• Flexible, supportive environment where well-being is prioritized
• Be Well programs designed to support financial, mental, physical, and social health
• Access to cutting-edge learning opportunities
• Certifications with Microsoft, Google, and Amazon
• Coaching and hands-on experiences

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed