Security Architect

AmTrust Financial Services•Cleveland, OH

About The Position

The Information Security Architect is responsible for designing, assessing, and advancing security architecture across identity and access management, infrastructure, cloud, applications, data, network, endpoint, third-party, and operational technology domains. As a member of the Security Architecture & Engineering team, this role partners with infrastructure, engineering, application development, and security leaders to influence and secure enterprise technology decisions. The role develops security architecture strategy, roadmaps, target-state architectures, standards, reference architectures, design patterns, and controls aligned with business objectives, cyber risk priorities, regulatory requirements, and industry practices. It leads architecture reviews and governance for complex, high-risk, and cross-functional initiatives; embeds secure-by-design principles; evaluates emerging technologies, including generative AI; and ensures technology and vendor decisions align with enterprise security priorities. The architect also collaborates across security, risk, technology, privacy, and compliance teams, and strengthens architecture capabilities through leadership, mentorship, and knowledge sharing.

Requirements

Bachelor’s degree in Cybersecurity, Computer Science, Computer Engineering, Information Technology, or a related field, or an equivalent combination of education and relevant work experience.
At least 5 years of progressive Information Security experience, with demonstrated expertise designing, implementing, and governing enterprise security capabilities.
Broad architecture experience across cybersecurity, infrastructure, cloud, applications, data, identity, and enterprise technology domains.
At least 5 years leading enterprise-wide cybersecurity architecture strategy, governance programs, architecture roadmaps, or large-scale security transformation initiatives.
Ability to translate business objectives, regulatory requirements, and cyber risk considerations into scalable security architectures, standards, and strategic technology decisions.
Strong knowledge of security architecture principles and frameworks, including Zero Trust, defense-in-depth, secure-by-design, cloud security, identity and access management, data protection, and cyber resilience.
Excellent communication, stakeholder management, and leadership skills, including the ability to influence technology and business leaders across organizational levels.

Nice To Haves

Professional security and architecture certifications such as CISSP, CCSP, CISM, SABSA, TOGAF, AWS Security Specialty, Microsoft Azure Security Engineer Associate, or equivalent credentials.
Knowledge of cybersecurity architecture frameworks, control frameworks, and industry standards, including NIST CSF, NIST SP 800-53, ISO 27001, CIS Critical Security Controls, SABSA, Zero Trust Architecture, Secure SDLC, threat modeling, and risk-based architectural decision-making.
Understanding of security architecture patterns across AWS, Azure, SaaS, IaaS, and PaaS, including microservices, APIs, IAM, PAM, encryption, key and secrets management, event-driven architectures, data protection, and security analytics.
Business and risk acumen, including knowledge of operating models, financial management, cost-benefit analysis, cyber risk quantification, and enterprise risk management.
Ability to define cybersecurity architecture strategy, develop multi-year roadmaps, and govern current- and target-state architectures at enterprise scale.
Ability to assess cyber threat trends, attack surface exposure, emerging technologies, and regulatory developments and translate findings into executive-level position papers, recommendations, and investment priorities.
Experience leading cross-functional initiatives across cybersecurity, infrastructure, engineering, application development, cloud, data, risk, privacy, and compliance, and mentoring architects and engineers.
Track record of influencing enterprise security strategy, reducing systemic cyber risk, enabling secure business transformation, and advising on cybersecurity investments and technology decisions.

Responsibilities

Lead development of the enterprise cybersecurity architecture vision and technology strategy, translating business objectives, cyber risk priorities, and security capabilities into roadmaps, target-state architectures, and guiding principles.
Establish, review, and govern cybersecurity architecture across identity, infrastructure, cloud, applications, data, network, endpoint, third-party, and operational technology domains.
Serve as the principal security architecture advisor for complex, high-risk, and cross-functional initiatives; lead architecture governance and ensure adherence to standards, policies, roadmaps, and control requirements.
Develop, maintain, and promote enterprise security reference architectures, design patterns, control frameworks, and architecture standards.
Partner with AI governance and technology stakeholders to design controls for secure development, deployment, and operation of AI-enabled solutions.
Define security architecture guidance for emerging technologies, including generative AI, addressing data protection, access governance, model risk management, responsible AI, and secure lifecycle controls.
Monitor threat intelligence, attack techniques, regulatory developments, and technology trends to identify strategic risks, opportunities, and future investment needs.
Ensure security, platform, and technology vendor selections align with enterprise architecture principles, cybersecurity strategy, risk appetite, and business objectives.
Embed security-by-design principles, including Zero Trust, least privilege, defense-in-depth, network segmentation, secure configuration, data protection, and cyber resilience.
Collaborate with security operations, risk management, infrastructure, engineering, application development, data, privacy, and compliance teams to support threat detection, incident response, disaster recovery, vulnerability management, and regulatory obligations.
Establish cybersecurity architecture quality standards that promote secure engineering, operational readiness, observability, resilience, and integrated response capabilities.
Strengthen organizational security architecture capabilities through mentorship, knowledge sharing, and leadership, fostering a security-first culture.
Comply with company policies, standards, and applicable regulatory requirements, including SOX IT General Controls, PCI DSS, GDPR, and CCPA.