Prin Cyber Security Architect

Constellation Energy Generation, LLC.•Baltimore, MD

About The Position

The Principal Cyber Security Architect partners with IT and business teams to provide expert leadership in security technology and security reference architecture solutions. The role weighs security technology standards, product availability, and the risks and benefits of introducing security technologies into computing environments. It provides comprehensive consultation to business units and IT management and staff on all aspects of security architecture, and develops and maintains business, systems, and IT/OT processes that support enterprise mission needs and requirements. The architect translates technology and environmental conditions, including laws and regulations, into IT/OT rules, requirements, security designs, and processes that describe baseline and target architectures. The role designs enterprise and systems security throughout the development lifecycle and operates independently with little or no direct supervision. The position designs and develops enterprise-wide security architecture and strategy aligned with business goals; advises on secure application development, architecture risk management, policies, standards, and implementations; and provides strategic technology guidance to IT leadership. It also maintains relationships with business and IT partners, communicates status to stakeholders, and evaluates security trends and technologies for their potential business impact.

Requirements

Bachelor's degree in Computer Science, Information Technology, or a related discipline, and typically 8 or more years of diverse experience in cybersecurity architecture and design, or an equivalent combination of education and work experience.
Expert knowledge of authentication, authorization, and access control methods.
Expert knowledge of computer and encryption algorithms, cryptography, and cryptographic key management concepts.
Expert knowledge of database systems, embedded systems, system fault tolerance methodologies, and how system components are installed, integrated, and optimized.
Expert knowledge of human-computer interaction principles and cybersecurity principles and organizational requirements concerning confidentiality, integrity, availability, authentication, and non-repudiation.
Ability to design architectures and frameworks and skill applying cybersecurity methods such as firewalls, demilitarized zones, and encryption.
Expert knowledge of network access, identity, and access; network protocols such as TCP/IP, DHCP, DNS, and directory services; and network design processes, including security and operational objectives and tradeoffs.
Expert knowledge of parallel and distributed computing concepts, security management concepts such as release and patch management, configuration management techniques, and cloud computing.
Comprehensive understanding of change management techniques associated with new technology implementation.
Demonstrated experience producing an economic business case and demonstrated leadership ability.
Proven analytical, problem-solving, and consulting skills.
Excellent communication skills and proven ability to work effectively with all levels of IT and business management.

Nice To Haves

Graduate degree in cybersecurity or a related area of expertise.
Relevant security certifications such as CISSP, CISM, SABSA, or GIAC.
Experience with Azure, Google Cloud Platform, and AWS, including building multi-cloud environments.
Demonstrated cybersecurity and information security expertise for applications, web architectures, operating systems, databases, and networks.
Experience with SCADA, ICS, Distribution Automation, Smart Grid, DMS, and ECS systems architecture.
Experience in application risk assessment, application security architecture development, web application security, and application security testing.
Experience in security architecture risk assessment, requirements development, secure design analysis, architecture assessment and development, and security testing of applications and systems.
Extensive experience developing, evaluating, and implementing cybersecurity and information security architectures, technologies, standards, and practices to secure applications and IT systems.
Knowledge and experience implementing governance frameworks and security risk management processes, including NIST, ISO, and COBIT guidelines and standards.
Experience addressing regulatory compliance requirements, including NERC CIP, SOX, PCI DSS, and HIPAA.
Understanding and experience with security development lifecycle processes for internally developed applications, including web-based and Internet-facing components.
Expertise in application security standards, methodologies, and technologies.
Ability to assess application and web architectures and operating systems for vulnerabilities and develop appropriate security countermeasures.
Knowledge and experience with IT security aspects of operating systems, Active Directory, SQL database access, LDAP, Microsoft SharePoint, and web server configurations.
Experience assessing, configuring, and testing security applications and systems, such as Cisco firewalls, security appliances, IDS/IPS, SSL or TLS, IPSec, and web services security.
Ability to demonstrate analytical skills, technical knowledge, and practical application of cybersecurity and information security principles to business leaders and technical staff.

Responsibilities

Provide technical and security expertise to IT and business teams to identify security technology solutions and develop security reference architectures and strategies that achieve business results.
Ensure appropriate implementation of security technology and reference architectures in development and production environments.
Analyze user needs and requirements to plan architecture.
Design and develop enterprise-wide security architecture and strategy across the security domain, aligned with business strategy and goals.
Develop and integrate cybersecurity designs for systems and networks with multilevel security requirements.
Provide input on security requirements for statements of work and other procurement documents.
Provide technical guidance and security expertise in secure application development, security architecture risk management and assessment, security policies and standards, and security architectures and implementations.
Advise IT leadership on strategic security technology and plans supporting business strategies, and translate proposed capabilities into technical requirements.
Establish, maintain, and enhance relationships with business and IT partners; regularly communicate status to key stakeholders.
Monitor trends and issues in security, evaluate new security technologies or opportunities, and analyze their potential business impact.