Principal Security Architect

Oakwood Systems Group Inc.•St. Louis, MO

About The Position

The Principal Security Architect is the hands-on technical and team leader for Oakwood Systems Group’s Security Solutions Group. The role delivers customer security projects and helps establish managed-services security offerings, leading security strategy, architecture, and delivery across Azure, Microsoft 365, and hybrid environments. It translates business goals, risks, and operational needs into architectures and prioritized roadmaps spanning Cloud Infrastructure, Data & AI, Application Development and agents, Modern Work, and Managed Services. As a trusted advisor to customer security and technology leaders, the architect owns technical direction and delivery quality, validates designs, and supports implementation, pre-sales, repeatable offerings, and recurring-service maturity. The position works across practices with their specialists and delivery leaders without assuming their ownership. Initial priorities include delivering customer projects and converting repeatable delivery patterns into managed security offerings with defined scope, deliverables, pricing inputs, support boundaries, runbooks, and readiness criteria. The architect works with managed-services and sales leaders to validate offerings through customer engagements and operational handoffs before expanding recurring-service commitments. The role leads a small team through technical direction, coaching, skills development, work allocation, capacity planning, and delivery accountability. It partners with project, service-line, and managed-services leaders on commercial and operational outcomes. The position does not independently own a 24×7 SOC or all incident-response coverage. The architect leads discovery, assessments, architecture and roadmap work; designs Zero Trust, identity, cloud, hybrid, Modern Work, data, AI, and security-operations controls; guides threat modeling and security reviews; and supports hands-on delivery, implementation validation, troubleshooting, and customer acceptance. The role also develops project-to-service transitions, recurring-service processes, estimates, statements of work, customer presentations, reusable architectures, and packaged consulting and security offerings. It communicates security tradeoffs, risk, cost, licensing, complexity, and operational impact to technical and executive audiences.

Requirements

10+ years in cybersecurity, infrastructure, identity, or cloud engineering, including 5+ years designing and delivering Microsoft security solutions and significant architecture leadership.
Experience owning complex customer security architecture from assessment and design through implementation, validation, and operational transition.
Experience providing small-team technical and people leadership across security projects and managed services, including coaching, resourcing, delivery, service levels, escalations, and operational transitions.
Deep hands-on expertise in at least two domains—identity and access, Azure/hybrid security, Microsoft 365 security, security operations, or data protection—with architectural breadth across the others.
Ability to guide cross-practice specialists; implementation expertise in every Oakwood service is not expected.
Strong knowledge of Entra ID, hybrid Active Directory security, Conditional Access, privileged access, least privilege, and identity lifecycle management.
Experience with Azure Policy, RBAC, network security, private endpoints, Key Vault, logging, and Defender for Cloud.
Architectural knowledge of Sentinel/Defender integration, detection engineering, incident workflows, telemetry costs, and security operations, with hands-on depth in core domains.
Working knowledge of Purview information protection and DLP, Intune compliance, and email and collaboration protection; ability to engage implementation specialists outside core expertise.
Practical application of Zero Trust, threat modeling, security baselines, and risk-based prioritization.
Architectural familiarity with AI and agent inventory, ownership, identity/access lifecycle, policies, monitoring, and retirement; ability to evaluate Agent 365 and AI-enabled security operations with appropriate oversight as capabilities evolve.
PowerShell, Kusto Query Language (KQL), and infrastructure-as-code or security automation skills sufficient to validate designs and guide implementation.
Ability to create architecture documents, recommendations, estimates, plans, and executive presentations; understanding of scope control, project economics, service effort, and measurable security outcomes.
Excellent consulting, presentation, whiteboarding, and writing skills; ability to lead multiple workstreams amid ambiguity and change.
Must be authorized to work in the United States without current or future visa sponsorship requirements; Oakwood is unable to provide visa sponsorship or transfer sponsorship for employment.

Nice To Haves

Advanced Microsoft security certifications, CISSP, CCSP, or comparable demonstrated expertise.
Regulated-industry security design and translation of audit or regulatory requirements into controls and evidence.
Purview governance, retention, insider risk, or broader information protection programs.
Security for Fabric, analytics, AI applications, copilots, and agents, including permissions, classification, workload/agent identities, API/connector authorization, oversharing, and monitoring.
Agent 365, Security Copilot/security agent, or Entra Global Secure Access pilots or implementations, including governance, human oversight, validation, and licensing or consumption considerations.
DevSecOps, Terraform or Bicep, CI/CD controls, container security, and application security collaboration.
Cyber resilience, protected backups, ransomware readiness, or continuity/disaster recovery validation; datacenter modernization or HPC/GPU security familiarity.
Security platform consolidation, licensing assessments, operating models, and managed-service transitions.
Microsoft-aligned engagements, co-sell, partner investments, Marketplace offerings, or capability development through skilling and delivery evidence.
Packaged consulting and recurring security offerings, including assessment methods, service boundaries, pricing inputs, maturity roadmaps, reference architectures, and accelerators.

Responsibilities

Lead customer discovery, security assessments, architecture workshops, and roadmap discussions to define business goals, threats, constraints, and success criteria.
Translate assessment findings into current- and target-state architectures, remediation backlogs, roadmaps, estimates, assumptions, dependencies, and risks; track maturity and report agreed security and operational measures.
Architect cloud and hybrid Zero Trust across identity, privileged access, devices, networks, applications, infrastructure, and data.
Design identity and network access using Microsoft Entra ID, Conditional Access, MFA, identity governance, Privileged Identity Management, workload and agent identities, hybrid identity, and, where appropriate, Entra Global Secure Access.
Architect Azure and hybrid security foundations, including landing zones, management groups, Azure Policy, RBAC, segmentation, private connectivity, encryption, key management, logging, and Defender for Cloud.
Design threat protection and security operations using Microsoft Sentinel and Defender, balancing telemetry coverage, ingestion and retention costs, detection quality, investigations, automation, and operational handoff.
Evaluate and operationalize Microsoft Security Copilot and security agents across Defender, Entra, Intune, and Purview, applying least privilege, human oversight, validation, and cost controls as licensing, feature availability, and operational readiness permit.
Guide Modern Work security for email, collaboration, external sharing, endpoints, device lifecycle, and data protection using Microsoft Defender, Intune, and Purview.
Lead security reviews and threat modeling for migrations, applications, APIs, connectors, copilots, and agents; partner with application specialists on identities, authorization, secrets, data exposure, monitoring, and secure development.
Govern enterprise AI and agent lifecycles, including discovery, inventory, ownership, onboarding, identity, least privilege, policy enforcement, monitoring, and retirement.
Partner with Data & AI specialists on permissions, classification, protection, governance, and monitoring for Microsoft Fabric, analytics, and AI data access; define control ownership and implementation responsibilities.
Partner with infrastructure and managed-services owners on protected backups, administrative separation, ransomware recovery readiness, and recovery validation against customer continuity and disaster recovery requirements.
Map controls to customer policies and frameworks such as NIST, CIS, and ISO 27001, distinguishing architecture guidance from formal compliance certification.
Create architecture diagrams, designs, decision records, control mappings, implementation plans, validation criteria, and executive recommendations.
Lead hands-on delivery by validating designs and configurations, resolving complex issues, reviewing implementation quality, and guiding engineering decisions and customer acceptance.
Lead the small Security Solutions Group through technical direction, people leadership, coaching, skills development, work allocation, and project and service accountability; coordinate formal personnel duties with the reporting leader.
Coordinate staffing, capacity, workload, and utilization with project and managed-services leaders; balance milestones, service commitments, and escalations and address resource and coverage gaps.
Oversee project scope, milestones, acceptance, and risks; partner with engagement and managed-services leaders on estimate accuracy, change control, delivery margin, service effort, and automation within the role’s authority.
Oversee recurring-service scope, runbooks, change control, service levels, posture reviews, and improvement; define ownership, ticket routing, escalation authority, and coverage with service desk, managed-services, customer, and SOC/MDR partners.
Coordinate incidents with operational owners without assuming independent 24×7 monitoring or response ownership.
Manage project-to-service transitions through readiness reviews, knowledge transfer, support documentation, monitoring requirements, and clear ownership; use delivery and service trends to prioritize automation, remediation, and improvement.
Develop solution approaches, estimates, SOWs, and customer presentations with account teams, engagement managers, engineers, and architects.
Connect immediate security needs to follow-on opportunities in identity, cloud, data protection, security operations, and managed services.
Align offerings with Microsoft secure AI and AI-ready productivity conversations, co-sell, applicable partner investments, and Marketplace routes alongside sales and alliance teams; support skilling and delivery evidence.
Use reference architectures, delivery standards, and knowledge-sharing practices to package repeatable project work into assessments, implementations, and recurring security services; define scope, deliverables, pricing inputs, acceptance, and support boundaries with sales and service-line leaders.
Lead consulting discovery, whiteboarding, solution presentations, and executive security briefings.
Build trust with customer executives, security leaders, architects, engineers, and business stakeholders, communicating clearly with technical and non-technical audiences.
Uncover unstated needs and explain tradeoffs, residual risk, cost, licensing, complexity, and operational impact without over-engineering.
Align security, infrastructure, application, data, compliance, and business teams with differing priorities.
Exercise professional judgment in difficult conversations, exception documentation, and expectation management.
Own technical quality and customer outcomes through proactive communication, accurate documentation, and follow-through.