Senior Cybersecurity Architect

NextEra Energy•Miami, FL

1d•Onsite

About The Position

NextEra Energy / Florida Power & Light is seeking a Senior Cybersecurity Architect to augment its Cybersecurity Architecture team and assess cybersecurity risks associated with new technology implementations across a large, complex enterprise. This is a senior-level, highly technical architecture and risk assessment role covering technologies such as cloud, SaaS, enterprise applications, infrastructure, networks, identity, APIs, AI/GenAI, OT/ICS, third-party solutions, and emerging technologies. The work spans the technology lifecycle, from early planning and solution design through formal architecture review, implementation support, and pre-production validation. The position follows a business-enablement approach. The architect identifies and communicates cybersecurity risks, defines controls and mitigations, and works with project teams and vendors to find practical ways to advance business objectives securely. The architect does not act as an approval or rejection gate. When risks remain unmitigated, they document residual risk so the appropriate Business Unit Director can make an informed risk-acceptance decision. The position is based in either the Miami or Juno Beach, Florida office and requires working onsite five days a week. The architect also develops and maintains high-level logical and technical IT architecture designs, provides strategic technical guidance, responds to emerging technologies, and helps deliver business outcomes through architecture decisions. The role includes developing roadmaps and standards, facilitating technology evaluations and risk assessments, and producing architecture artifacts such as reference architectures.

Requirements

Demonstrated senior-level experience performing cybersecurity architecture, solution security, or technology risk assessments in large and complex enterprise environments.
Strong understanding of cybersecurity architecture principles and their application across diverse technology environments.
Strong working knowledge of cloud security architecture, including IAM, networking, data protection, workload security, logging and monitoring, encryption, and shared-responsibility models in AWS, Azure, and/or GCP.
Strong working knowledge of network and infrastructure security, including segmentation, firewalls, WAFs, proxies, DNS, load balancers, certificates, encryption, remote access, and secure connectivity.
Strong working knowledge of application security, including authentication and authorization, APIs, web application security, secrets management, secure design patterns, OWASP risks, and third-party integrations.
Strong working knowledge of identity and access management, including SSO, federation, MFA, RBAC, privileged access, service/workload identities, and least privilege.
Strong knowledge of data security and privacy architecture, including protection of sensitive and regulated information throughout its lifecycle, data classification, encryption, key management, tokenization, and DLP.
Demonstrated ability to perform threat modeling and identify attack surfaces, trust boundaries, realistic threat scenarios, and potential attack paths.
Ability to interpret vulnerability assessments, penetration-test findings, and vendor-provided security assessment results and determine their relevance to architecture risk.
Experience evaluating third-party/vendor technologies and challenging vendor security assertions when supporting evidence is incomplete or insufficient.
Working knowledge of cybersecurity frameworks and standards, including NIST CSF, NIST SP 800-53, NERC CIP, and ISO/IEC 27001.
Broad working knowledge of regulatory and compliance considerations and judgment to recognize when specialized legal, privacy, compliance, or regulatory expertise should be engaged.
Ability to independently lead architecture review meetings and guide technical discussions to a clear risk determination.
Ability to manage multiple concurrent assessments in a high-volume, fast-paced environment.
Strong analytical, critical-thinking, and problem-solving skills.
Strong written communication skills, particularly the ability to develop concise and defensible cybersecurity risk statements.
Strong interpersonal skills and ability to establish productive relationships with application/project teams and third-party vendors.
Ability to translate technical cybersecurity concerns into practical mitigation requirements.
Ability to work independently with minimal supervision, identify missing information, ask appropriate technical questions, and drive assessments through completion.
High school diploma or GED, and a bachelor's degree or equivalent experience.
At least 4 years of experience.

Nice To Haves

Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Engineering, or a related discipline; equivalent relevant professional experience will be considered.
Industry certifications such as CISSP, CCSP, or comparable cybersecurity, cloud, or architecture certifications.
Experience performing cybersecurity architecture assessments within a Fortune 500 or similarly large, complex enterprise.
Experience with multiple cloud environments, such as AWS, Microsoft Azure, and Google Cloud Platform.
Familiarity with OT/ICS cybersecurity environments and the security and operational considerations of critical infrastructure, including safety, availability, reliability, and regulatory constraints.
General awareness of emerging AI/GenAI security risks and considerations.
Experience contributing to cybersecurity reference architectures, reusable security patterns, technical standards, or architecture guidance.
Experience in a utility, critical infrastructure, or other highly regulated environment.

Responsibilities

Independently lead cybersecurity architecture reviews for complex projects, platforms, applications, infrastructure, cloud services, SaaS platforms, vendor solutions, APIs, and enterprise integrations.
Analyze solution architectures, network and data flows, trust boundaries, authentication models, integrations, external connectivity, and security controls.
Perform threat modeling to identify realistic threat scenarios, attack paths, trust-boundary concerns, and potential security weaknesses.
Identify cybersecurity risks, assign risk ratings using enterprise methodologies and professional judgment, and explain the technical and business implications.
Define required and recommended security controls and practical mitigation strategies.
Produce concise, defensible risk documentation that explains exposure, potential impact, risk rating, mitigation requirements, and residual risk.
Document residual cybersecurity risks requiring Business Unit Director acceptance when appropriate mitigations will not be implemented.
Assess internet-facing technologies and external attack surfaces, including web applications, APIs, exposed services, authentication mechanisms, WAFs, DDoS protections, DNS, certificates, ingress architectures, and external connectivity.
Assess cloud architectures, including identity and access management, networking, workload security, logging and monitoring, data protection, encryption, and shared-responsibility models.
Evaluate application security architecture, including authentication and authorization, APIs, web application security, secrets management, encryption, secure architecture patterns, OWASP risks, and third-party integrations.
Evaluate identity and access management architectures, including SSO, federation, MFA, RBAC, privileged access, service/workload identities, and least-privilege principles.
Evaluate data security and privacy considerations across data classification, collection, storage, processing, transmission, encryption, access controls, retention, and third-party handling of sensitive or regulated information.
Assess cybersecurity resiliency, including single points of failure, backup and recovery dependencies, ransomware resilience, and the operational impact of cybersecurity controls.
Critically review vendor security architectures and technical evidence, including security assessments, penetration-test results, vulnerability scans, and architecture documentation.
Recognize regulatory, privacy, and compliance implications, including NERC CIP, and engage subject-matter experts when specialized expertise is required.
Develop reusable cybersecurity architecture patterns, reference architectures, standards, and implementation guidance for recurring risks or architecture patterns.
Facilitate architecture review sessions with application teams, project teams, technical stakeholders, and third-party vendors.
Guide migration and modernization strategies and coordinate with domain specialists for novel or high-risk technical decisions.
Mentor cybersecurity professionals, share technical knowledge, and improve review methods, templates, and architecture quality.
Monitor industry threats and technology trends and incorporate relevant improvements into architecture standards and patterns.
Independently manage a high volume of concurrent cybersecurity architecture assessments while maintaining quality and meeting established review timelines.
Work with business partners to analyze strategy and trends and define requirements, principles, and models that guide technology decisions.
Communicate and enforce technology standards with business partners.
Apply existing, new, and emerging technologies in response to industry trends; drive digital innovation and develop technology roadmaps.
Define high-level migration plans to address gaps in the current state.
Coach, mentor, and lead technical subject matter experts to promote consistency across technology architectures.
Design and own governance, assurance, and standards activities for enterprise technology architecture compliance.
Oversee and facilitate evaluation, risk assessment, selection, and design of hardware and software technology and product standards.
Deliver technology architecture artifacts, which may include reference architectures or concepts of operation.
Perform other job-related duties as assigned.