Senior Architect, Cybersecurity

NASCO Senior Architect, Cybersecurity

Location: Hartford, Connecticut

Under general direction, the Senior Architect, Cybersecurity, is primarily responsible for shaping security solutions and playing a key role in the evolution of the organization’s Enterprise Architecture and Security functions. This role is responsible for providing security-related thought leadership and architecture guidance across a wide range of technologies and business initiatives. This role is accountable for establishing Information Security Standards, Technologies, Patterns, Reference Architectures and Best Practices and ensuring their adoption across all Product and corporate solutions. This includes advising and guiding the business and delivery teams in the planning, design and implementation of all solutions. This position reports to the Chief Information Security Officer regarding work, projects, and other engagements, and works as part of a matrixed IT organization to help bridge the gaps between business leadership, risk management and IT delivery in terms of Information Security Architecture and Technology.

Responsibilities

1. Develops security architecture strategies for the organization in the form of standards, frameworks and guidelines, with the emphasis on application security, network security and identity and access management concerns.
2. Serves as primary information security interface to collaborate with product teams, business representatives, systems development and business users for establishing business requirements, information security functional requirements, security solution options and implementation plans.
3. Advises and contributes to strategies and initiatives to strengthen the Security Program which is identified as part of the corporate Information Security Practice or HITRUST corporate compliance.
4. Provides security controls, processes and technical advisory support to business units and projects by working cross-functionally to develop and implement strategies that balance security recommendations with business needs.
5. Works with leadership to develop a run book for the operational organization to enable safe and rapid responses to reported vulnerability disclosures.
6. Provides mentoring and technical leadership to the team.
7. Acts as Subject Matter Expert and provides third-level support, resolving the most difficult technical issues.
8. Establishes and maintains an effective relationship with product management and product engineering leadership as a trust advisor.
9. Adapts and supports the enterprise business strategy, gains executive approval and support, and oversees successful execution of initiatives.
10. Reviews and gains approval of security specific technical solutions through the architecture governance process.
11. Helps define department strategic objectives and drives business outcomes in alignment to the organizational strategy.

Qualifications

Required Knowledge, Skills, and Abilities:

1. Basic understanding of HITRUST framework.
2. Broad knowledge of information security processes and technologies such as: business process design, risk assessment, minimum baseline security controls (*nix, Windows, network protocols, common services), data classification and management, security monitoring and log analysis, incident management, application and database architectures, SDLC, system planning and integration, and security metrics.
3. Advanced knowledge of technologies such as operating systems, directory services and network protocols.
4. Basic knowledge of database applications, spreadsheet design, and report writing software.
5. Advanced written and verbal communications skills.
6. Ability to facilitate the development and application of architecture artifacts between product and engineering teams and customers.
7. Effective communication skills, both verbal and written, including the ability to communicate appropriately across all levels of an organization.
8. Advanced knowledge of business to business (B2B) and business to consumer (B2C) product lifecycle management and technology road-mapping processes.
9. Knowledge of multiple delivery methodologies, product operating models, and SaaS product deployment environments.
10. Intermediate skills in cloud security architecture and standard cloud security configurations and controls.
11. Ability to accomplish service goals, objectives and metrics consistent with Information Security Department strategic plans and business service level agreements.
12. Ability to resolve business security conflicts taking into consideration policy, risk and business needs.
13. Ability to perform trade-off and risk analysis and, if necessary, process and manage exceptions to achieve business needs.
14. Advanced knowledge of network security and principles.
15. Advanced knowledge of PKI, TLS/SSL, and basic cryptography principles.
16. Advanced knowledge of Identity and Access Management principles and Privileged Access Management, including SAML2, OpenID Connect, and OAuth2.
17. Basic knowledge of automation and scripting.

Experience:

1. 5 - 8 years of experience in enterprise security architecture role.
2. 10 years of IT infrastructure architecture and/or operations experience.
3. 4 years of experience in Large Scale System design (ERP, Custom, etc.) and implementation.
4. 3 years of experience with commercial and open source security applications and technologies (e.g. malware prevention, DLP, IDS/IDP, cryptography, vulnerability scanning and penetration testing), as well as related protocols and tools (e.g. SSH, SSL/TLS, snort, port scanners, rootkit detectors, etc.).
5. 3 years of experience performing network and application security penetration testing and/or threat assessments.
6. 3 years of experience architecting solutions in a cloud environment.

Required Certification:

• Certification: CISSP

Benefits Overview

At NASCO, we trust our workforce to be fully remote, working from their home . This benefit offers significant, personalized outcomes for each associate including work/life balance, savings on commuting, work clothing, and increased time to spend on personal activities.

Our full benefit package is designed to support the physical, mental, and financial health of our associates. We offer:

• Choice of Blue Cross Blue Shield Medical, Dental, and Vision Plans.
• Telehealthcare – for Medical and Behavioral visits.
• Generous PTO with buy/sell options.
• 9 Company holidays, a floating day off, and a day off for volunteering.
• Employee Assistance Program.
• Wellness program - earn insurance discounts or credit towards health-related items.
• 401K Plan with employer matching contributions.
• Company-funded spending/reimbursement accounts to help with out-of-pocket medical expenses.
• Bonus and Recognition programs.
• Tuition Assistance.
• Consultation with financial planner.
• Basic Life & AD&D Insurance, Short and Long-Term Disability Insurance provided, and Supplemental Term Life Insurance is available.
• Group Discount programs - mobile, technology services, etc., to help you save money.

Other Benefits

• E-Learning – Comprehensive and current library of e-learning and performance support assets, available on demand and at no cost.

NASCO is an Equal Opportunity Employer/veterans/disability/race/color/religion/sex/sexual orientation/gender identity/national origin. Must have legal authority to work in the US.