· Lead the Cybersecurity Architecture & Engineering function and provide direction, coaching, prioritization, performance support, and professional development for the Cybersecurity Architect and Cybersecurity Engineer.
· Own the end-to-end Cybersecurity Architecture & Engineering service offering, including service scope, intake, engagement model, standards, deliverables, roadmaps, metrics, and continuous improvement.
· Define and maintain enterprise security architecture principles, standards, reference architectures, reusable patterns, engineering requirements, and security guardrails.
· Partner closely with Infrastructure, Digital, Data, Enterprise Architecture, and Application teams to integrate security into planning, architecture, design, build, deployment, migration, change, and operational processes.
· Design and establish new security architecture and engineering processes where existing processes do not adequately support secure technology delivery.
· Establish security participation in architecture review boards and related technology governance forums. Develop practical, low-friction intake, triage, review, escalation, exception, and approval processes that engage security early and provide clear, timely guidance.
· Ensure security architecture reviews and design decisions occur early enough to influence solution direction, reduce rework, improve supportability, and avoid unnecessary delivery delays.
· Lead security architecture reviews for cloud initiatives, infrastructure changes, identity services, endpoint platforms, digital capabilities, applications, integrations, APIs, data flows, collaboration services, and emerging technologies.
· Guide the design of secure end-to-end solutions that connect distributed systems and business processes through integrations, APIs, event flows, orchestration, and automated workflows.
· Ensure end-to-end designs address identity, authentication, authorization, device trust, secrets, encryption, network controls, data protection, logging, monitoring, resilience, third-party dependencies, user experience, and secure failure behavior.
· Define security architecture and engineering requirements for networks, secure connectivity, segmentation, remote access, cloud networking, platform services, and hybrid technology environments.
· Provide architecture and engineering leadership across the Microsoft ecosystem, including Microsoft Entra, Microsoft Intune, Microsoft 365, Azure, and related identity, endpoint, collaboration, and security capabilities.
· Guide the design of modern identity and access capabilities, including adaptive and risk-based access, device trust, authentication strength, passwordless authentication, passkeys, privileged access, application access, and identity lifecycle integration.
· Establish reusable security patterns and guardrails for managed devices, conditional access, authentication, administrative access, application access, secure collaboration, and platform configuration.
· Ensure identity, endpoint, and collaboration controls are risk-based, forward-looking, and designed to minimize unnecessary user friction while maintaining appropriate protection, governance, visibility, and resilience.
· Lead security architecture and engineering considerations for platform modernization and technology transitions, ensuring integrations, dependencies, user impact, operational readiness, control design, and support requirements are addressed as part of the end-to-end solution.
· Evaluate new and evolving platform capabilities and determine how they should be adopted, configured, integrated, and governed to improve security outcomes, operational efficiency, and user experience.
· Establish and mature application security capabilities, including secure software development lifecycle practices, threat modeling, application architecture reviews, secure coding requirements, and engineering standards.
· Implement and govern DevSecOps practices, including static application security testing, dynamic application security testing, software composition analysis, secrets scanning, container security, API security, and Infrastructure-as-Code security controls.
· Ensure code scanning and automated security validation are embedded into CI/CD pipelines, supported by actionable remediation workflows, and measured for effectiveness.
· Define cloud security requirements and reusable patterns for Microsoft Azure and Google Cloud Platform services, identities, networks, workloads, data services, APIs, logging, monitoring, and platform configurations.
· Drive remediation of architectural and engineering risks through collaboration with technology owners and business stakeholders.
· Develop architecture and engineering roadmaps aligned to cybersecurity strategy, enterprise technology direction, platform modernization, and business objectives.
· Establish metrics, KPIs, and maturity measures that demonstrate early security engagement, review efficiency, adoption of secure patterns, control coverage, user impact, and measurable risk reduction.