Senior Enterprise IT Security Architect

AHEAD

2d•$180,000 - $200,000

About The Position

AHEAD builds platforms for digital business by combining cloud infrastructure, automation and analytics, and software delivery. The company emphasizes a culture of belonging and is an equal opportunity employer. The Senior Enterprise IT Security Architect is a hands-on technical consultant who leads the design and implementation of Isolated Recovery Environments (IREs), also known as cyber clean rooms, for enterprise clients. The role focuses on creating isolated recovery capabilities that let organizations restore critical systems and identity infrastructure after ransomware or other destructive cyber events without recontamination. The architect owns IRE architecture and deployment from initial design through implementation and validation, leads engagement teams typically ranging from 3 to 15 people, and works directly with clients. The position's compensation range is $180,000–$200,000 in on-target earnings (OTE), including base salary and any applicable target bonus. The range may vary based on relevant experience, qualifications, and geographic location. AHEAD offers training and development, cross-department training, and certification sponsorship. U.S. employment benefits include medical, dental, and vision insurance, a 401(k), paid company holidays, paid time off, and paid parental and caregiver leave.

Requirements

At least 10 years of relevant enterprise IT security architecture, infrastructure, or cyber recovery experience.
Hands-on experience designing and deploying isolated, air-gapped, or highly segmented recovery environments.
Strong practical knowledge of network segmentation, firewalling, VLANs, routing controls, and isolation techniques in on-premises and cloud platforms.
Deep understanding of Active Directory, including isolated forest recovery procedures, DNS and time dependencies, and identity separation principles.
Experience with platform services, including virtualization platforms such as VMware or Hyper-V, cloud infrastructure on AWS, Azure, or GCP, storage, and core networking services.
Architectural knowledge of modern backup and cyber recovery platforms such as Rubrik and Cohesity sufficient to design integration and data-flow patterns; hands-on operational experience with these tools is not required.
Demonstrated ability to lead technical teams of varying sizes on complex infrastructure and security projects.
Strong consulting and client communication skills.
U.S. citizenship.

Nice To Haves

Experience with Privileged Access Management (such as CyberArk), phishing-resistant MFA, and Privileged Access Workstation design.
Hands-on work with immutable storage, object lock, or equivalent write-once protections.
Prior involvement in ransomware recovery, clean-room recovery, or large-scale cyber resilience engagements.
Relevant certifications such as CISSP, CISM, or platform-specific credentials in VMware, Microsoft, or major cloud providers.
Experience with Infrastructure-as-Code or automation approaches for repeatable IRE builds.
Knowledge of related frameworks or controls such as NIST or CIS applied to recovery architectures.

Responsibilities

Lead the architecture, design, and hands-on deployment of Isolated Recovery Environments for on-premises, cloud, and hybrid environments.
Design and implement isolation controls, including network segmentation, physical or logical air-gapping, one-way replication paths, and firewall and VLAN strategies.
Architect independent IRE platform services, including compute, storage, networking, DNS, DHCP, monitoring, and virtualization, without shared trust or dependencies on production.
Design and guide Active Directory forest recovery inside the isolated environment, including separate identity planes, no production AD trust relationships, independent time sources, and controlled validation and promotion paths.
Define secure administration models, including Privileged Access Workstations, restricted access methods, just-in-time access, and PAM integration considerations.
Ensure immutable storage and backup ingestion designs, and apply architectural knowledge of platforms such as Rubrik and Cohesity to clean data transfer into the IRE.
Develop recovery runbooks, validation procedures, and testing approaches so clients can safely restore, scan, and promote workloads.
Lead and mentor delivery teams, typically 3–15 consultants or engineers, through design and deployment; provide technical direction and quality oversight.
Work directly with client stakeholders to translate cyber resilience requirements into practical, implementable IRE designs.
Document client architectures, standards, and recommendations.