Senior Principal Security Architect

MetLife•Tampa, FL

3d•$165,000 - $215,000•Hybrid

About The Position

The Senior Principal Security Architect is the senior technical leader for Security Architecture within MetLife Global Security and the primary escalation point for security architecture matters. The role leads risk-based Security Architecture Reviews (SARs) for enterprise technology and platform initiatives, resolves complex or contested design decisions, and mentors security architects across the US and MGCC. The architect evaluates proposed designs, identifies material risks, recommends proportionate controls, and guides teams toward target-state architectures, reference patterns, and roadmaps. The position also advances the Security Architecture practice by setting review standards, creating reusable reference architectures, and shaping enterprise security transformation through current-state assessments, maturity modeling, and roadmap development. The work spans applications, platforms, cloud services, infrastructure, AI, integrations, and major transformation programs, with close collaboration across technology, risk, governance, and business stakeholders. This is a hybrid role requiring at least three days per week in the office. The posting lists New York, New York; Warren, New Jersey; and Tampa, Florida as alternative posting locations, and the general information section lists Cary, North Carolina. Travel required is 10%.

Requirements

At least 12 years of experience in technology, including at least 7 years in security architecture or security engineering at enterprise scale.
Strong experience in security architecture, enterprise architecture, security engineering, or cyber risk, with responsibility for reviewing or designing complex technology solutions.
Demonstrated experience mentoring or technically leading architects or engineers and serving as a final technical authority or escalation point on complex security decisions without formal reporting lines.
Expertise in threat modeling, risk assessment, attack path analysis, trust-boundary assessment, control gap analysis, and security remediation planning.
Deep understanding of security architecture patterns, including identity-centric security, zero trust, least privilege, defense-in-depth, segmentation, secure access, data protection, secure integration, and secure-by-design principles.
Ability to evaluate security controls and technologies, determine control applicability and architecture fit, and make risk-based recommendations balancing protection, usability, delivery speed, and operational feasibility.
Experience developing reference architectures, security standards, guardrails, architecture decision records, or reusable design patterns for enterprise teams.
Strong understanding of enterprise architecture practices, including current-state assessment, target-state architecture, roadmap planning, maturity modeling, capability modeling, and transformation leadership.
Executive-level communication skills, including explaining risk and trade-offs to engineers, governance bodies, and senior leadership and maintaining a well-reasoned position under delivery pressure.
Experience working effectively with globally distributed teams across time zones.

Nice To Haves

Experience supporting Security Architecture Review, Architecture Review Board, technology governance, cloud governance, or risk acceptance processes in a large enterprise.
Hands-on or architecture experience with identity platforms, privileged access management, conditional or risk-based access, role-based access control, federation, secrets management, and workload or non-human identity patterns.
Experience with SASE, ZTNA, micro-segmentation, API security, B2B connectivity, cloud connectivity, and secure hybrid network architecture.
Experience with cloud-native architectures, container platforms, Kubernetes, DevSecOps pipelines, infrastructure as code, policy as code, vulnerability management, posture management, logging, monitoring, detection, and response integration.
Familiarity with AI security risks and controls, including model misuse, sensitive data exposure, excessive agency, prompt injection, insecure integrations, supply chain risk, agentic AI, tool or plugin integrations, MCP security, AI governance workflows, and secure AI deployment patterns.
Experience influencing cross-functional architecture decisions and leading stakeholders toward target-state designs, standard patterns, measurable maturity improvements, and practical implementation roadmaps.
Relevant certifications such as CISSP, CCSP, SABSA, TOGAF, Microsoft Cybersecurity Architect Expert (SC-100), AWS Certified Security – Specialty, Azure or Google Cloud security certifications, CCSK, or other security architecture credentials.

Responsibilities

Serve as the primary escalation point for security architecture matters, resolving contested findings, high-risk or novel designs, and disagreements, and escalating when appropriate.
Define security architecture review standards, risk-rating criteria, and documentation templates; ensure quality and consistency of SAR outcomes; technically review and sign off on high-risk assessments.
Mentor security architects through paired reviews, threat-modeling sessions, design critiques, and technical feedback.
Lead knowledge-sharing, maintain the security pattern library, support onboarding, and act as technical delegate for the Security Architecture leader.
Represent Security Architecture at the Architecture Review Board, technology governance and risk forums, and with senior leadership.
Partner with the Securing Emerging Tech team on AI and emerging-technology reviews to maintain consistent patterns and risk positions.
Lead and oversee SAR assessments across enterprise applications, platforms, cloud services, infrastructure, AI solutions, integrations, and transformation programs; personally own the highest-risk and most complex engagements.
Perform threat modeling and risk assessments to identify design gaps, control weaknesses, trust-boundary concerns, attack paths, data exposure risks, and operational impacts.
Evaluate security controls, tools, and technologies against architecture requirements, enterprise standards, risk posture, and control-effectiveness objectives.
Design and recommend secure architecture patterns across IAM, network, devices, applications, data, cloud, security operations, governance/risk/compliance, and AI.
Develop and maintain reusable security reference architectures, decision patterns, implementation guardrails, and design principles.
Provide identity-centric security architecture guidance covering authentication assurance, authorization, privileged access, least privilege, role-based access, non-human identities, and lifecycle integration.
Advise on network segmentation, micro-segmentation, secure access, zero trust access, ingress and egress controls, and connectivity models.
Design risk-based access policies for users, workloads, devices, applications, data, and administrative functions, considering sensitivity, exposure, business criticality, and operational requirements.
Assess current-state security architecture and define target-state architecture, transition roadmaps, maturity models, and strategic recommendations for enterprise security transformation.
Partner with enterprise architecture, application, cloud/platform, network engineering, IAM, data protection, SOC, GRC, privacy, legal, and risk stakeholders to develop implementable security recommendations.
Document architecture decisions, risks, assumptions, compensating controls, and remediation actions for technical teams, governance bodies, and leadership, including risk statements supporting formal risk acceptance.

Benefits

Medical and prescription drug coverage
Vision insurance
Dental insurance
No-cost short- and long-term disability
Company-paid life insurance
Legal services
Company-funded retirement pension
401(k) with employer matching
Group discounts on voluntary insurance products, including auto and home, pet, critical illness, hospital indemnity, and accident insurance
Employee Assistance Program (EAP) and digital mental health programs
Parental leave
Paid time off
Paid holidays
Volunteer time off
Tuition assistance
Possible annual short-term incentive compensation and stock-based long-term incentives, subject to applicable plan terms