Architect - Information Security and Identity

Location: Issaquah, WA
Date Posted: 01-03-2019
Description of position
The Information Security Architect plays an integral role in defining and assessing the organization's security strategy, architecture and practices. The Information Security Architect will be required to effectively translate business objectives and risk management strategies into specific security processes enabled by security technologies and services.


Tasks and responsibilities
  • Translates complex security-related matters into business terms that are readily understood by colleagues. Presents analyses in person and in written formats to senior leadership.
  • Interprets business, technology and threat drivers, and develops practical security roadmaps to deal with these drivers.
  • Demonstrates flexibility within a variety of changing situations, while working with individuals and groups. Changes his or her own ideas or perceptions in response to changing circumstances. Alters standard procedures, when necessary, and multitasks when required.
  • Develops and maintains a security architecture process that enables the enterprise to develop and implement identity and security solutions and capabilities that are clearly aligned with business, technology and threat drivers.
  • Develops identity and security strategy plans and roadmaps based on sound enterprise architecture practices.
  • Develops and maintains identity and security architecture artifacts (e.g., models, templates, standards and procedures) that can be used to leverage security capabilities in projects and operations.
  • Tracks developments and changes in the digital business and threat environments to ensure that they're adequately addressed in security strategy plans and architecture artifacts.
  • Participates in application and infrastructure projects to provide security-planning advice.
  • Drafts security procedures and standards to be reviewed and approved by executive management and/or formally authorized by the VP of Information Security and Compliance.
  • Determines baseline security configuration standards for operating systems (e.g., OS hardening), network segmentation, and identity and access management (IAM).
  • Develops standards and practices for data encryption and tokenization in the organization, based on the organization's data classification criteria.
  • Conducts or facilitates threat modeling of services and applications that tie to the risk and data associated with the service or application.
  • Ensures a complete, accurate and valid inventory of all systems, infrastructure and applications that should be logged by the security information and event management or log management tool.
  • Establishes a taxonomy of indicators of compromise (IOCs) and share this detail with other security colleagues, including Information Security VP, directors, managers and analysts, as well as counterparts within the network teams.
  • Coordinates with our future DevOps teams to advocate secure coding practices.
  • Validates IT infrastructure and other reference architectures for security best practices and recommend changes to enhance security and reduce risks, where applicable.
  • Validates security configurations and access to security infrastructure tools, including firewalls, IPSs, WAFs and anti-malware/endpoint protection systems.
  • Reviews network segmentation to ensure least privilege for network access.
  • Liaise with the internal audit (IA) team to review and evaluates the design and operational effectiveness of security-related controls.
  • Reviews security technologies, tools and services, and make recommendations to the broader security team for their use, based on security, financial and operational metrics.
  • Liaise with other security architects and security practitioners to share best practices and insights
  • Responsible for research and evaluation of new tools and technologies, and the individual is expected to stay abreast of new developments in the technology and retail industry.
  • Serves in capacity of technology advisory services for engaging with the business to "solve” business problems via technology and process innovation relative to IT capability requirements.
  • Participates in PCI and SOX compliance process; and follow their standards in architecting solutions.
  • Provides technology thought leadership - assessing priority of new project requests toward ensuring added value, promoting our business strategies and/or advancing our technology.
  • Assists in other areas of the department and company as necessary.


Required skills, abilities, and certifications
  • Minimum of eight years in an engineering and architectural role.
  • Experience in using architecture methodologies such as SABSA, Zachman and/or TOGAF.
  • Direct, hands-on experience or strong working knowledge of managing security infrastructure — e.g., firewalls, intrusion prevention systems (IPSs), web application firewalls (WAFs), endpoint protection, SIEM and log management technology.
  • Verifiable experience reviewing application code for security vulnerabilities.
  • Direct, hands-on experience or a strong working knowledge of vulnerability management tools.
  • Documented experience and a strong working knowledge of the methodologies to conduct threat-modeling exercises on new applications and services.
  • Documented experience and a strong working knowledge of the methodologies to conduct threat-modeling exercises on new applications and services.
  • Full-stack knowledge of IT infrastructure:
    • Applications
    • Databases
    • Operating systems — Windows, Unix and Linux
    • Hypervisors
    • IP networks — WAN and LAN
    • Storage networks — Fibre Channel, iSCSI and NAS
    • Backup networks and media
  • Direct experience designing IAM technologies and services:
    • Active Directory
    • Lightweight Directory Access Protocol (LDAP)
    • Cloud (Azure) IAM
  • Strong working knowledge of IT service management (e.g., ITIL-related disciplines):
    • Change management
    • Configuration management
    • Asset management
    • Incident management
    • Problem management
  • Regulations, Standards and Frameworks
    • Payment Card Industry Data Security Standard (PCI-DSS)
    • HIPAA-HITECH
    • Validated Systems (e.g., GAMP)
    • Sarbanes-Oxley
    • General Data Protection Regulation (GDPR)
    • Privacy Practices
    • ISO 27001/2
    • NIST Cybersecurity Framework (CSF)
    • ITAR
 
Recommended skills, abilities, and certifications
  • Successful internal candidates will have spent one year or more on their current team.
this job portal is powered by CATS