Information Security Architect

Job Summary

The Information Security Architect provides architectural leadership on multiple complex projects and business technologies. This role will develop and promote technical roadmaps to modernize, enhance, and support technology enabled business solutions. This role will participate in F&G’s Architecture Review Board (ARB) sessions and presents solution designs to the ARB for approval.  In addition, this role will strategize with business and technology stakeholders to define future-state business capabilities and requirements and translate into transitional and target state architectures.

Duties and Responsibilities

• Develop security strategy plans and roadmaps based on sound enterprise architecture practices.
• Provide architectural vision to align Information Security to strategic business needs and goals.
• Develop and maintain security architecture artifacts (models, templates, standards and procedures) that can be used to leverage security capabilities in projects and operations.
• Contribute to and participate in Architecture Review Board and Architect community activities to ensure design and implementation of sound solutions.
• Contribute to strategic roadmap and technical direction of business and IT.
• Develop standards and practices for security, including baseline security configuration standards, network segmentation, IAM, data encryption and tokenization, etc.
• Track developments and changes in the digital business and threat environments to ensure that these are adequately addressed in security strategy plans and architecture artifacts.
• Validate IT infrastructure and other reference architectures for security best practices, and recommend changes to enhance security and reduce risk where applicable.
• Validate security configurations and access to security infrastructure tools, including firewalls, intrusion prevention systems (IPSs), web application firewalls (WAFs), anti-malware/endpoint protection systems, etc.
• Conduct or facilitate threat modeling of services and applications that tie to the risk and data associated with the service or application.
• Coordinate with the compliance and privacy officers to understand sensitive data within the organization (e.g., PII or ePHI) and recommends controls to ensure this data is adequately secured.
• Participate in application and infrastructure projects to provide security planning advice.
• Liaison with the business continuity management team to validate security practices for both disaster recovery planning (DRP) and business continuity management (BCM) testing and operations when a failover occurs.

Experience and Education Requirements

• Bachelor’s degree in information systems, computer science, or related field or equivalent experience 
• Master’s degree, MBA, or similar preferred
• CISSP, ITIL, CISM, GIAC certification, or similar
• 10+ years of experience in Information Security, preferably within Life/Annuity or related industry
• Extensive experience in Information Security, compliance, assurance, and/or other security standard methodologies and principles
• Substantial experience architecting, designing, engineering, integrating, deploying, and maintaining cloud solutions and implementing security controls
• Expertise in Azure public cloud, cloud native design, microservice architecture, containerization and non-functional requirements
• Experience with developing specific cybersecurity countermeasures and risk mitigation strategies for systems and/or applications as well as direct, hands-on experience managing security infrastructure
• Experience in identifying, assessing, and recommending cybersecurity or cybersecurity-enabled
• Full-stack knowledge of varied IT infrastructures
• Direct experience designing IAM technologies and services (e.g., Active Director, LDAP, Azure AD)
• Strong working knowledge of IT service management (e.g., ITIL-related disciplines):
• Experience planning the security of cloud services (e.g., SaaS, PaaS, IaaS)
• Experience with regulations, standards, and frameworks (e.g., Sarbanes-Oxley, NIST CSF, ISO 27001, SSAE18, NY DFS, CCPA)

Skills and Abilities

• Strong team building, partnership, collaboration, and resource management skills
• Demonstrated ability to prioritize/communicate conflicting demands in a fast-paced environment
• Strong analytical and interpersonal skills with good written and verbal communication
• Proven ability to mentor and develop talent and drive a team for results
• Strong attention to detail and ability to manage multiple priorities, assign appropriate resources, ensure quality, and maintain high standards
• Strong working knowledge of IT service management (e.g., ITIL-related disciplines)
• Knowledge of Agile (Scrum, Kanban) and DevSecOps methodologies

Other Requirements

• Perform other functions, duties and projects as assigned
• Regular and punctual attendance
• Minimal travel required (less than 10%)

#LI-MB1 #LI-Remote