Principal Cybersecurity Infrastructure Engineer

M&T Bank•Buffalo, NY

1d•Hybrid

About The Position

Responsible for designing, implementing, and optimizing enterprise security architectures, platforms, and frameworks that protect users, applications, data, and cloud services. Leads development and enhancement of Security Service Edge (SSE) capabilities, including Web/Cloud Proxy, Data Loss Prevention (DLP), Cloud Access Security Broker (CASB), Zero Trust Network Access (ZTNA), and Enterprise Browser. Addresses complex cybersecurity challenges while aligning security outcomes with business objectives, regulatory requirements, and evolving threats. Serves as a knowledge resource and mentor to less experienced engineers across cybersecurity disciplines, supporting both daily engineering operations and strategic transformation initiatives. The role designs and implements enterprise security architectures and data protection strategies across endpoints, cloud environments, SaaS platforms, collaboration tools, email, and AI applications. It develops Zero Trust approaches based on continuous verification, least privilege, segmentation, identity, device trust, and risk-adaptive access. It also designs security governance and risk controls for AI platforms and services, cloud infrastructure, workloads, and enterprise data. The position works with stakeholders across Cybersecurity, Technology, Legal, Risk, Compliance, Data Governance, business units, and executive leadership. It exercises significant autonomy in selecting methods, technologies, architecture patterns, and implementation approaches, and serves as a trusted technical advisor and subject matter expert in SSE, data protection, Zero Trust, cloud security, and AI security. This role has no supervisory responsibilities. The position is based at Seneca One in Buffalo, New York, and requires working onsite four days per week, with the flexibility to work from home one day per week.

Requirements

Bachelor's degree and at least 7 years of relevant work experience, or a combined minimum of 11 years of higher education and/or work experience in lieu of a degree.
Advanced understanding of SSE, Secure Web Gateway (SWG), CASB, ZTNA, Enterprise Browser, data protection, and Zero Trust Architecture principles.
Expertise designing enterprise-scale cloud security architectures across hybrid and multi-cloud environments.
Expert knowledge of security architecture, infrastructure lifecycle management, vendor best practices, and enterprise systems design.
Ability to translate business, regulatory, and operational requirements into scalable security solutions and technical implementations.
Advanced critical thinking, risk analysis, and problem-solving skills.
Excellent communication and interpersonal skills, including the ability to explain complex technical concepts to executive, technical, risk, audit, and business audiences.
Experience partnering with senior leaders to design and implement strategic cybersecurity solutions that support business objectives.
Experience collaborating with and influencing peers, stakeholders, and executive leadership.
Proficiency in cross-functional collaboration, decision-making, and organizational change management.
Ability to serve effectively in an indirect leadership role while driving enterprise-wide security initiatives.
Ability to analyze large datasets, security telemetry, and operational metrics to identify trends and support informed decisions.
The role requires onsite work four days per week at Seneca One in Buffalo, New York, with one work-from-home day per week.

Nice To Haves

Experience securing AI platforms, generative AI applications, and AI-enabled business processes using governance, monitoring, and AI security solutions.
Industry certifications such as CISSP, CCSP, GIAC, Microsoft Security Certifications, or equivalent.

Responsibilities

Partner with senior engineers and leadership to define enterprise SSE, Zero Trust, and data protection strategies that reduce risk and support business transformation, cloud adoption, hybrid work, and AI initiatives.
Lead architecture, engineering, configuration, and deployment of Web/Cloud Proxy, CASB, DLP, ZTNA, Enterprise Browser, and related security platforms and controls.
Define testing methodologies, validation frameworks, and security-effectiveness metrics for data protection technologies.
Lead complex system and technology deployments, coordinating cross-functional teams and providing technical oversight.
Establish tuning standards, operational baselines, and best practices for data protection policies, cloud access governance, email protection, browser security, and Zero Trust enforcement.
Lead automation initiatives using APIs, orchestration platforms, AI capabilities, and security workflows to improve efficiency and reduce manual effort.
Design and implement data protection strategies to identify, classify, govern, monitor, and protect sensitive data across endpoints, cloud services, collaboration platforms, email, and SaaS applications.
Architect and enhance ZTNA solutions using identity-, device-, application-, and risk-aware access controls in place of legacy network-centric models.
Collaborate with Cybersecurity, Technology, Legal, Risk, Compliance, Data Governance, and business stakeholders to integrate security controls into business processes and transformation initiatives.
Evaluate emerging technologies, threat intelligence, industry trends, and regulatory requirements to continuously improve cybersecurity effectiveness.
Maintain strategic vendor relationships and oversee issue resolution, product roadmaps, and operational optimization for key security technologies.
Advise leadership on security technology investments, budget planning, platform rationalization, and future-state architecture.
Lead adoption and governance of AI security capabilities, including visibility, risk management, policy enforcement, and secure integration of AI applications and services.
Understand and follow company risk and regulatory standards, policies, controls, and Risk Appetite.
Design, implement, maintain, and enhance internal controls; identify risk issues requiring escalation; and implement audit and regulatory findings in a timely manner.
Promote a workplace environment that supports belonging and reflects the M&T Bank brand.
Complete other related duties as assigned.
Design security architectures using SSE capabilities to secure access to applications, internet resources, and organizational data regardless of user location.
Architect data classification, labeling, information protection, insider risk management, data lifecycle management, compliance, and governance capabilities.
Design and implement governance, monitoring, and risk management for enterprise AI platforms, including AI application discovery, data protection, regulatory compliance, and AI risk visibility.
Design and implement controls protecting cloud infrastructure, SaaS applications, cloud workloads, and enterprise data from cybersecurity threats.
Develop and maintain multi-year technology roadmaps and strategic plans for assigned security platforms, aligned with enterprise architecture, cybersecurity strategy, and business priorities.
Design and implement security controls for regulatory and compliance requirements, including NYS DFS, GLBA, FFIEC guidance, data privacy obligations, and internal risk standards.