Senior Security Architect - TS/SCI

Sunayu•Bethesda, MD

1d•Onsite

About The Position

The Senior Security Architect provides technical security expertise to secure, harden, and maintain compliance of cloud-based software platforms and infrastructure across multiple secure networks. The role applies security technologies, industry best practices, vulnerability management, and Risk Management Framework (RMF) practices. It works with compliance personnel, software and systems engineers, system architects, and Government counterparts on systems and cybersecurity engineering to support regulatory compliance and system security posture. The architect designs and evaluates security architectures for large, complex, geographically distributed systems, including multi-cloud environments spanning AWS, Azure, GCP, and OCI. The role integrates cloud-native security services with enterprise platforms and designs security solutions for Kubernetes and containers, enterprise networks, vulnerability management, SIEM, identity, secrets management, scanning, and data protection. It also assesses existing architectures, recommends technologies and implementation plans, tunes controls, and advises program and customer stakeholders. The position is based in Bethesda, Maryland, and requires an active or current TS/SCI clearance and the ability to obtain a polygraph. The posting describes work with secure networks and customer organizations; it does not state a salary amount. Sunayu supports professional growth with company-reimbursed training and continuing education of up to $5,000 per year, and participation in industry conferences and events.

Requirements

Active or current Top Secret/SCI clearance and ability to obtain a polygraph.
Bachelor of Science degree from an accredited university, ideally in Computer Science, Information Assurance, Information Security System Engineering, or a related field.
At least 12 years of experience as an Information Systems Security Engineer (ISSE) or Systems Engineer on programs and/or contracts in the customer space.
At least one IAT certification and one IAT Level II-or-higher certification, such as CCNA Security, CySA+, Security+ CE, or CISSP (or Associate).
Ability to obtain Privileged User Account (PUA) or elevated access in accordance with DoD policy.
Solid understanding of security practices and policies, and hands-on vulnerability testing experience using customer tools.
Experience applying the Risk Management Framework.
Demonstrated knowledge of and experience with common security tools, such as ACAS, Prisma Cloud, and Splunk or Elastic.
Experience with SCAP- or STIG-based tools and specifications.
Extensive experience designing enterprise security solutions and translating security requirements into implementable technical architectures.
Knowledge of Kubernetes and container security architectures, including image security, admission controls, secrets, identity, network policies, software supply chain security, and runtime protection.
Experience designing solutions involving SIEM, vulnerability management, identity security, network security, secrets management, container scanning, and data protection technologies.
Experience with data modeling and mapping system data flows for cybersecurity analysis.
Understanding of microservices architecture and service mesh.

Nice To Haves

Active TS/SCI clearance with polygraph.
Experience with Commercial Cloud Services (C2S) and cloud-based enterprise services, preferably AWS.
Five years of experience with defense-in-depth principles and technologies, including access control, authorization, identification and authentication, public key infrastructure, and network and enterprise security architecture, and applying risk assessment methodology to system development.
DoD 8570 compliance with IASAE Level 2 or 3.
Experience installing, configuring, testing, deploying, operating, and maintaining enterprise network-based scanning and reporting tools, such as Trellix/ESS, ACAS, Evaluate STIG, SteelCloud ConfigOS, Prisma Cloud, and STIG Manager.
Extensive experience hardening modern operating systems, such as Oracle Linux and RHEL, and Microsoft Windows environments using Security Technical Implementation Guides (STIGs).
Information Systems Security Engineering Professional (ISSEP) certification.
Computer Information Systems Security Professional (CISSP) certification.
Experience designing, implementing, and maintaining Splunk environments, including forwarders, indexers, search heads, and deployment servers.
Hands-on experience with two or more of Palo Alto Prisma Cloud, Splunk, Elastic, or Evaluate STIG.

Responsibilities

Validate and verify system security requirements and establish security designs for large-scale systems, major system elements, and interfacing systems in complex, geographically distributed network environments.
Recommend and develop technical solutions, products, and standards based on current and desired security architecture.
Collaborate with internal technical experts and communicate with program managers and customer points of contact about significant security issues.
Participate in Program Increment Planning and related agile team activities.
Work with systems engineering, test engineering, and integration teams to ensure hardware and software architecture and implementation meet security requirements.
Evaluate how new development affects operational system security posture.
Serve as a security architecture subject matter expert and advise program managers, customer technical experts, and internal program teams.
Improve engineering processes, documentation standards, implementation playbooks, migration runbooks, technical standards, and execution models.
Design security architectures across AWS, Azure, GCP, and OCI, accounting for common patterns and cloud-provider-specific capabilities and limitations.
Architect integrations between native security services and enterprise security platforms, including vulnerability management, STIG evaluation, and SIEM products.
Design and implement security architectures for Kubernetes and containers, including image security, admission controls, secrets, identity, network policies, software supply chain security, scanning, and runtime protection.
Design, engineer, and implement enterprise network security architecture spanning firewalls, intrusion detection and prevention, web and TLS proxies, VPN and encryption services, network access control, DNS security, and east-west controls.
Evaluate network security architecture, identify gaps and improvement opportunities, estimate effort, assess implementation risk, and develop practical engineering plans.
Specify network security architecture, evaluate and recommend emerging security technologies, and conduct needs assessments to inform design and investment decisions.
Tune and optimize security controls to reduce false positives, close coverage gaps, and improve detection and enforcement without degrading network performance or availability.
Monitor system security status, identify risks and vulnerabilities, and coordinate remediation with system owners, engineers, and other stakeholders.
Design, implement, and maintain Splunk environments, including forwarders, indexers, search heads, and deployment servers, as a preferred qualification.

Benefits

Three medical plan options
Dental and vision
FSA, DCFSA, and HSA
Life and AD&D insurance
Short-term and long-term disability
Employee Assistance Program (EAP)
Company-reimbursed training and continuing education assistance of up to $5,000 per year
Paid Time Off (PTO)
11 federal holidays
401(k) plan with up to a 6% match and immediate 100% vesting
Participation in industry conferences and events