Senior Security Architect

Ensono

9d•$155,000 - $210,000•Hybrid

About The Position

The Senior Security Architect is a senior technical leader responsible for defining and advancing secure architecture across Ensono’s enterprise technology environment, with primary emphasis on cloud platforms and artificial intelligence. The role translates business, technology, risk, privacy, and compliance requirements into practical security principles, reference architectures, design patterns, standards, and guardrails. The architect partners with Enterprise Architecture, Cloud Engineering, Application Development, Infrastructure, Security Operations, Risk and Compliance, Privacy, and business stakeholders to ensure solutions are secure by design, resilient, scalable, and support business growth. The role provides hands-on design leadership across Azure, AWS, GCP, SaaS, hybrid infrastructure, AI-enabled applications, generative AI platforms, AI agents, model and data pipelines, and third-party integrations. It also supports broader security architecture domains, including identity, network, application security, data protection, Zero Trust, logging and monitoring, vulnerability management, resilience, and third-party risk. Ensono encourages associates to work remotely most of the time when client-site work is not required; associates may choose to work from home or in Ensono offices. The role is offered on a full-time schedule, with an estimated annual pay range of $155,000–$210,000. Eligible additional compensation may include an annual performance-based bonus and an equity grant.

Requirements

Bachelor’s degree in Computer Science, Information Security, Information Technology, Engineering, Mathematics, or a related field, or equivalent relevant experience.
8 or more years of cybersecurity experience, including significant responsibility for security architecture and the design and review of secure enterprise solutions.
Experience designing and reviewing security architectures for complex enterprise environments spanning cloud security, identity and access management, Zero Trust, data protection, network security, threat modeling, and secure-by-design principles.
Experience designing cloud security architectures in Microsoft Azure and/or AWS, including multi-cloud and hybrid-cloud environments.
Experience designing or governing controls for cloud identity and privileged access, CSPM/CWPP, network segmentation, containers and Kubernetes, serverless services, encryption, key and secrets management, cloud logging and monitoring, and infrastructure as code.
Experience conducting security architecture or risk assessments for AI/ML and generative AI solutions, including LLM applications, RAG, AI agents, model APIs, gateways, AI data flows, and third-party AI services.
Ability to translate business, technology, risk, privacy, and compliance requirements into security architectures, standards, reference patterns, guardrails, and actionable technical requirements.
Experience leading or contributing to threat modeling and risk analysis and incorporating secure SDLC, DevSecOps, defense in depth, least privilege, and security architecture governance into solution designs.
Experience applying security frameworks and controls to solution designs, including NIST CSF, NIST SP 800-53, NIST SP 800-160, NIST SP 800-207, NIST AI RMF, CSA CCM, CIS Controls and Benchmarks, ISO/IEC 27001, and OWASP guidance.
5 or more years of cybersecurity experience in professional services, consulting, or managed services, supporting complex enterprise or client environments.
Experience leading security architecture reviews for complex enterprise solutions, identifying material risks, defining required controls and mitigations, documenting residual risk, and presenting recommendations to technical and executive stakeholders.

Nice To Haves

Experience implementing cloud landing-zone security, policy-as-code, DevSecOps controls, and architecture review processes.
Experience with Microsoft Defender for Cloud, Microsoft Sentinel, Microsoft Purview, Entra ID, Azure Policy, AWS Organizations, Security Hub, GuardDuty, Config, CloudTrail, or comparable capabilities.
Knowledge of AI-specific threats and controls, including prompt injection, sensitive-data disclosure, excessive agency, insecure tool use, model and data poisoning, adversarial testing, model theft, output integrity, and AI supply chain risk.
Familiarity with ISO/IEC 42001, OWASP guidance for LLM and generative AI applications, and AI governance or model risk management practices.
Relevant certifications such as CISSP, CCSP, SABSA, AWS Security Specialty, Microsoft Cybersecurity Architect Expert, Azure Security Engineer Associate, or comparable architecture and cloud security credentials.

Responsibilities

Own and evolve enterprise cloud and AI security architecture principles, roadmaps, reference architectures, reusable design patterns, and technical standards.
Lead security architecture reviews for new solutions, material changes, cloud deployments, AI use cases and agents, SaaS platforms, applications, APIs, and third-party integrations.
Translate business and technical requirements into risk-informed security requirements and designs that balance protection, usability, scalability, cost, and delivery speed.
Design and review secure multi-cloud and hybrid architectures, including cloud identity, privileged access, network segmentation, private connectivity, workload protection, containers, serverless services, data protection, key and secrets management, logging, monitoring, resilience, and recovery.
Define cloud governance guardrails using policy-as-code, infrastructure-as-code security, secure baselines, configuration standards, posture management, workload protection, and continuous compliance capabilities.
Assess cloud architectures against shared-responsibility requirements and clarify ownership of controls among cloud service providers, Ensono, customers, and third parties.
Define security architecture for generative AI, machine learning, AI-enabled applications, retrieval-augmented generation, AI gateways, AI agents, plugins, tools, APIs, and Model Context Protocol integrations.
Establish AI security requirements covering data classification and handling, model and agent access, non-human identities, least privilege, prompt-injection defenses, secure retrieval sources, output validation, model and software supply chain risk, audit logging, monitoring, human oversight, and emergency disablement.
Perform threat modeling and abuse-case analysis for cloud and AI solutions, documenting threats, attack paths, trust boundaries, mitigations, residual risk, and required monitoring.
Partner with application and platform teams to embed security requirements into the system development lifecycle, CI/CD pipelines, cloud landing zones, architecture review gates, and deployment processes.
Provide expert guidance on Zero Trust, identity-centric security, data-centric protection, secure APIs, segmentation, cryptography, security telemetry, and defense in depth.
Document architecture decisions, control mappings, exceptions, risks, and remediation recommendations; present design options and residual risk to technical and executive stakeholders.
Collaborate with Security Operations and Incident Response to ensure cloud and AI architectures generate appropriate telemetry and support detection, investigation, containment, and recovery.
Evaluate emerging technologies, security products, and supplier capabilities; contribute to technology selection, proofs of concept, and strategic security roadmaps.
Mentor engineers, architects, and delivery teams; deliver knowledge transfer and promote consistent application of security architecture standards.

Benefits

Unlimited paid days off
Three health plan options
401(k) with company match
Eligibility for dental, vision, short- and long-term disability, life and AD&D coverage, and flexible spending accounts
Family Forming Benefit, including fertility coverage and adoption/surrogacy reimbursement
Paid childbearing and paternal leave
Education reimbursement, student loan assistance, or 529 college funding
Sabbatical leave
Wellness program
Flexible work schedule
Annual bonus plan based on company and individual performance, subject to eligibility
Equity grant under the Associate Equity Appreciation Program, subject to eligibility