Principal Enterprise Security Architect (SME)

• Enterprise Security Architecture: Develop and maintain the enterprise security architecture roadmap, aligning technology investments and security initiatives with strategic objectives across network defense, cloud security, endpoint protection, transport security, and certificate lifecycle management.
• Security Assessment and Risk Management: Conduct comprehensive architectural reviews of hybrid infrastructure environments, identifying structural vulnerabilities, security gaps, and opportunities to strengthen enterprise resilience through proactive monitoring and risk-based remediation.
• Network and Perimeter Defense: Design, evaluate, and optimize security solutions spanning intrusion detection and prevention systems (IDS/IPS), next-generation firewalls (NGFW), web application and API protection (WAAP), web application firewalls (WAF), secure web gateways, proxies, DNS protection, load balancing, and software-defined networking.
• Cloud and Zero Trust Security: Define and implement security architecture principles across AWS, Microsoft Azure, and Google Cloud Platform (GCP), incorporating Zero Trust, Secure Access Service Edge (SASE), Security Service Edge (SSE), Cloud Access Security Broker (CASB), and Zero Trust Network Access (ZTNA) capabilities.
• Strategic Technical Leadership: Serve as a principal security architecture advisor to CISO engineering leadership, translating complex technical risks and infrastructure vulnerabilities into clear business-risk assessments and actionable recommendations.
• Cross-Functional Collaboration: Lead architecture reviews, threat modeling, and remediation initiatives in partnership with network engineering, endpoint management, security operations, infrastructure teams, and external vendors.
• Governance and Compliance: Establish and maintain security policies, technical standards, and governance processes aligned with recognized frameworks, including NIST Cybersecurity Framework, NIST SP 800-53, and CIS Critical Security Controls.
• Security Engineering and Automation: Guide the evolution of security engineering capabilities by leveraging security intelligence, artificial intelligence, and automation to improve operational efficiency, strengthen threat detection, and streamline security processes.
• Infrastructure and Certificate Security: Oversee or advise on security workstreams involving public key infrastructure (PKI), certificate authority operations, network detection and response (NDR), endpoint detection and response (EDR/XDR), security information and event management (SIEM), and transport security.
• Incident Response and Continuous Improvement: Contribute to security incident response activities, evaluate emerging attack techniques, and continuously improve architectural controls to address evolving threats and operational requirements.

Requirements

• Education: Bachelor's degree in engineering, information technology, cybersecurity, or a related discipline, or equivalent relevant professional experience. Candidates without a relevant degree must have an additional four years of applicable experience.
• Professional Experience: Extensive cybersecurity and infrastructure experience, including a strong background in enterprise security architecture and a demonstrated ability to influence complex technical decisions. The original posting references both 10+ years of relevant experience and 15+ years of experience in key security architecture and infrastructure domains.
• Certifications: Required certifications include CCIE and CISSP, demonstrating advanced expertise in network engineering and information security.
• Network and Perimeter Security: Deep hands-on architectural experience with enterprise network defense, IDS/IPS, NGFW, WAF/WAAP, SD-WAN security, DNS protection, proxies, web proxies, PAC files, load balancers, IP routing, and data center architecture.
• Cloud and Hybrid Infrastructure: Proven experience securing large-scale enterprise environments spanning multiple physical data centers and cloud platforms, including AWS, Azure, and GCP.
• Advanced Security Architecture: Strong knowledge of PKI, certificate lifecycle management, NDR, EDR/XDR, SIEM, cloud security, endpoint protection, and secure transport technologies.
• Modern Security Frameworks: Practical experience implementing Zero Trust principles, SASE/SSE architectures, CASB, secure web gateways, and ZTNA solutions.
• Governance and Risk Management: Demonstrated ability to develop security policies, enforce technical standards, manage governance workstreams, and align infrastructure designs with NIST and CIS security frameworks.
• Automation and Emerging Technologies: Familiarity with security intelligence automation, AI fundamentals, and AI application development methodologies. Training in Microsoft Azure, GCP, AWS, Splunk, and AI fundamentals is desirable.
• Incident Response: Understanding of security incident response processes and the ability to contribute to effective threat mitigation and continuous security improvement.
• Communication and Leadership: Excellent analytical, communication, stakeholder management, and problem-solving skills, with the ability to explain complex security issues in business-relevant terms and lead collaboration across multidisciplinary teams.
• Background Screening: Ability to obtain and maintain a Public Trust clearance (MBI/Tier 2) and successfully complete the required government background investigation, including fingerprinting.
• U.S. Residency Requirement: Candidates must satisfy the applicable five-year U.S. residency requirements for the government screening process. Specific rules regarding consecutive time spent outside the United States vary according to citizenship status.
• Work Authorization: U.S. citizenship is not explicitly required for this position, but candidates must meet the applicable residency and background screening requirements.

Benefits

• Annual Salary: Estimated base salary range of $147,292–$199,278, depending on experience, geographic location, and contractual requirements.
• Annual Schedule: Full-time position with a standard 40-hour workweek.
• Remote Flexibility: Fully remote work arrangement, with additional listed work locations in Morrisville, North Carolina; Falls Church, Virginia; and Eagan, Minnesota.
• Retirement Savings: 401(k) retirement plan with employer matching contributions.
• Healthcare Coverage: Medical plan options, including plans with Health Savings Accounts (HSAs), along with dental and vision insurance.
• Paid Time Off: Typically 15 days of paid leave per calendar year for eligible new employees, plus 10 paid holidays annually. Leave is prorated based on the employee's start date.
• Family and Personal Leave: Paid parental leave, eligible paid family leave of up to 160 hours within a rolling 12-month period, and additional leave options for illness, personal matters, military service, bereavement, and jury duty.
• Insurance and Income Protection: Short- and long-term disability coverage, life insurance, accidental death and dismemberment insurance, personal accident coverage, critical illness insurance, and business travel accident insurance.
• Professional Development: Opportunities for career advancement, internal mobility, paid education, professional certifications, and continuous learning in cybersecurity, cloud computing, and artificial intelligence.
• Work-Life Balance: Flexible workweek arrangements where operational requirements permit.
• Travel: Limited travel requirements, expected to be less than 10%.