Senior Security Architect - TS/SCI

Sunayu•Bethesda, MD

3d•$131,300 - $237,350•Onsite

About The Position

The Senior Security Architect provides technical security expertise to secure, harden, and maintain compliance of cloud-based software platforms and infrastructure across multiple secure networks. The role applies security technologies, industry best practices, vulnerability management, and Risk Management Framework (RMF) practices to develop and implement security solutions. It collaborates with compliance personnel, software and system engineers, system architects, and Government counterparts across systems and cybersecurity engineering activities to ensure regulatory compliance and a strong security posture. The position designs and evaluates security architectures for large-scale systems and complex, geographically distributed network environments. Its scope includes multi-cloud security across AWS, Azure, GCP, and OCI; integration of cloud-native security services with enterprise platforms; Kubernetes and container security; and enterprise network security architecture. The architect also assesses security gaps, recommends technologies and improvements, evaluates implementation risks, and tunes controls to improve detection and enforcement while preserving network performance and availability. The role contributes to agile planning and works with program, customer, engineering, test, and integration stakeholders. It provides security architecture expertise to program teams and customer technical experts, assesses how new development affects operational security, and improves engineering processes, documentation, implementation playbooks, migration runbooks, technical standards, and execution models. Sunayu, LLC serves the Defense and Intelligence communities with mission-critical engineering solutions. The company describes a collaborative culture focused on professional growth and open communication, and offers company-reimbursed training and continuing education of up to $5,000 per year.

Requirements

Active or current Top Secret/SCI clearance and ability to obtain a polygraph.
Bachelor of Science degree from an accredited university, ideally in Computer Science, Information Assurance, Information Security System Engineering, or a related field.
At least 12 years of experience as an Information Systems Security Engineer (ISSE) or System Engineer on programs and/or contracts with the customer space.
At least one IAT certification and one IAT Level II or higher certification, such as CCNA Security, CySA+, Security+ CE, or CISSP (or Associate).
Ability to obtain Privileged User Account (PUA) or elevated access in accordance with DoD policy.
Solid understanding of security practices and policies and hands-on vulnerability testing experience using customer tools.
Experience applying the Risk Management Framework.
Demonstrated knowledge of and experience with common security tools such as ACAS, Prisma Cloud, and Splunk/Elastic.
Experience with SCAP- or STIG-based tools and specifications.
Extensive experience designing enterprise security solutions and translating security requirements into implementable technical architectures.
Knowledge of Kubernetes and container security architectures, including image security, admission controls, secrets, identity, network policies, software supply chain security, and runtime protection.
Experience designing solutions involving SIEM, vulnerability management, identity security, network security, secrets management, container scanning, and data protection technologies.
Experience with data modeling and mapping system data flows for cybersecurity analysis.
Understanding of microservices architecture and service mesh.

Nice To Haves

Active TS/SCI clearance with polygraph.
Experience with Commercial Cloud Services (C2S) and cloud-based enterprise services, preferably AWS.
Five years of experience with Defense in Depth principles and technology, including access control, authorization, identification and authentication, public key infrastructure, network and enterprise security architecture, and applying risk assessment methodology to system development.
DoD 8570 compliance with IASAE Level 2 or 3.
Experience installing, configuring, testing, deploying, operating, and maintaining enterprise network-based scanning and reporting tools such as Trellix/ESS, ACAS, Evaluate STIG, SteelCloud ConfigOS, Prisma Cloud, and STIG Manager.
Extensive experience hardening Oracle Linux, RHEL, and Microsoft Windows environments using Security Technical Implementation Guides (STIGs).
Information Systems Security Engineering Professional (ISSEP) certification.
Computer Information Systems Security Professional (CISSP) certification.
Experience designing, implementing, and maintaining Splunk environments, including forwarders, indexers, search heads, and deployment servers.
Hands-on experience with two or more of Palo Alto Prisma Cloud, Splunk, Elastic, or Evaluate STIG.

Responsibilities

Validate and verify system security requirements and establish security designs for large-scale systems, major system elements, and interfacing systems in complex, geographically distributed networks.
Recommend and develop technical solutions, products, and standards based on current and desired system security architecture.
Collaborate with internal technical experts and communicate significant security issues to Program Managers and customer organization points of contact when necessary.
Participate in Program Increment Planning and related agile team activities.
Work with System Engineering, Test Engineering, and Integration teams to ensure hardware and software architecture and implementation meet security requirements.
Evaluate the impact of new development on the operational security posture of systems.
Serve as a security architecture subject matter expert and advise Program Managers, customer technical experts, and internal program teams.
Improve engineering processes, documentation standards, implementation playbooks, migration runbooks, technical standards, and execution models.
Design security architectures across AWS, Azure, GCP, and OCI, accounting for shared patterns and cloud-provider-specific capabilities and limitations.
Architect integrations between native security services and enterprise platforms, including vulnerability management products, STIG evaluation, and SIEM.
Apply security architecture knowledge to Kubernetes and containers, including image security, admission controls, secrets, identity, network policies, software supply chain security, scanning, and runtime protection.
Design, engineer, and implement enterprise network security architecture spanning firewalls, intrusion detection and prevention, web and TLS proxies, VPN and encryption services, network access control, DNS security, and east-west security controls.
Evaluate network security architecture, identify gaps and improvements, estimate effort, assess implementation risk, and develop practical engineering plans.
Specify network security architecture, evaluate and recommend emerging technologies, and perform needs assessments to inform design and investment decisions.
Tune security controls to reduce false positives, close coverage gaps, and improve detection and enforcement without degrading network performance or availability.
Monitor system security status, identify risks and vulnerabilities, and coordinate remediation with system owners, engineers, and other stakeholders.
Design, implement, and maintain Splunk environments, including forwarders, indexers, search heads, and deployment servers (preferred qualification).