Security-Architect, Enterprise-Architect, Cloud-Security-Architect Jobs

Description

WHO WE ARE

Come join the company at the center of how the world adopts AI securely. Cyera’s mission is to give enterprises the confidence to embrace AI safely — deciding exactly what it can see and do as it reaches deeper into the business. We started by solving the hardest problem in data security: finding and securing data faster and more precisely than anyone thought possible. That foundation is now the essential AI trust infrastructure for the Fortune 1000. We’re hiring mission-driven talent to put those leaders at the center of our story.

THE OPPORTUNITY

As the Senior Security & Enterprise Architect, you will design and implement the security and enterprise architecture strategy across Cyera's internal ecosystem. You will define standard architecture guidelines and governance patterns for engineering teams, lead architectural evaluations for software acquisitions and internal systems, and partner with Security to evaluate, communicate, and mitigate enterprise risk through informed, risk-based decision-making.



RESPONSIBILITIES:

• Set the standards: Own security architecture standards, reference patterns and guardrails that security engineering and IT build against, so teams can move fast and stay secure.
• Run architecture reviews: Stand up and chair an Architecture Review Board for new applications, vendors, acquisition integrations and AI adoption, making clear calls on what to approve, consolidate or decline.
• Drive third-party governance: Support GRC by building an end-to-end third-party risk management lifecycle, establishing a single source of truth for all vendors and apps, and maintaining clear application catalog ownership.
• Be the architecture voice externally: Serve as the technical voice for customer and auditor architecture questions, including security questionnaires and enterprise reviews, so answers are accurate and consistent.
• Keep decisions documented: Maintain architecture decision records (ADRs) and diagrams so the reasoning behind our choices is clear, current and easy to reuse.

Requirements

REQUIRED QUALIFICATIONS:

• 10+ years in security or enterprise architecture, including design work in a SaaS or cloud-native environment.
• Strength in IAM/IGA, cloud security (AWS, GCP, and Azure), SaaS and app-integration security, and data security (DSPM/DLP).
• Hands-on experience architecting AI/agentic systems and securing LLM tooling.
• Familiarity with ISO 27001/42001, SOC 2, NIST, and the vendor-risk and audit frameworks that follow from them.
• Pragmatic, comfortable pushing back on engineering and IT, and able to use AI tools to prototype quickly.

Nice to have

• TOGAF, SABSA, CISSP or CCSP; experience in a global enterprise.



COMPENSATION INFORMATION:

Compensation Range: $160,000-$200,000.

The range represents total compensation, and may include incentive for sales roles, equity or benefits, as applicable.

This compensation range represents Cyera’s good faith and reasonable estimate of the range of possible compensation for this role at the time of posting, and Cyera may ultimately pay more or less than the posted range. The final salary for this position will be determined in Cyera’s sole discretion, consistent with applicable law, and based on a variety of factors, including but not limited to the employee’s work experience, skills, and qualifications for the role, as well as the needs of Cyera’s business and other operational considerations.

Final compensation will vary based on seniority and relevance of experience, location, and position requirements.

This role may be eligible for potential merit increases based on factors such as individual or company performance, time in role, and other discretionary factors. In addition to a standard benefits and equity package, we offer a generous salary. Final compensation will vary based on seniority and relevance of experience, location, and position requirements.

This role may be eligible for potential merit increases based on factors such as individual or company performance, time in role, and other discretionary factors.​

BENEFITS - Why Cyera?

• Ability to work remotely, with office setup reimbursement
• Unlimited PTO
• Paid holidays and sick time
• Health, vision, and dental insurance
• Life, short and long-term disability insurance

Originally posted on Himalayas

Key Responsibilities

Serve as the lead architect and subject matter expert for enterprise security strategy, design, and modernization across on-premises, managed hosting, hybrid, and cloud environments.
Define and maintain a cohesive, layered security architecture that clearly establishes trust boundaries, control placement, security responsibilities, and where prevention, detection, response, and visibility should occur throughout the environment.
Establish standardized front-door patterns for externally accessible applications and services using technologies such as F5 BIG-IP, Akamai, cloud-native web application firewalls, and other approved edge-security controls.
Develop phased migration strategies to place existing public-facing websites and applications behind approved enterprise ingress and application-security services, including workloads hosted in data centers, managed hosting environments, Microsoft Azure, and Amazon Web Services.
Identify and address direct-to-origin exposure and other paths that could allow traffic to bypass approved application delivery, certificate management, logging, or security controls.
Design secure and resilient enterprise ingress and egress architectures, including additional egress capabilities, security service chaining, load-balancer-based architectures, centralized certificate management, and highly available traffic-management patterns.
Evaluate the effectiveness of border, upstream, mid-tier, and downstream firewall controls. Identify opportunities to simplify rule sets, eliminate unnecessarily permissive access, improve early-path blocking, and reduce the operational burden placed on downstream security platforms.
Validate whether network and application-security controls are operating as intended through architecture reviews, configuration analysis, traffic-flow validation, and telemetry assessment. Collaborate with service providers and engineering teams to identify enforcement, visibility, and ownership gaps across security layers.
Establish and lead an enterprise PKI architecture, including certificate authority and trust models, certificate enrollment and issuance, key protection, revocation, lifecycle management, governance, automation, and integration with enterprise and cloud-hosted systems.
Define enterprise IAM architecture patterns addressing authentication, authorization, identity federation, privileged access, machine and workload identities, network access control, and the integration of identity context with infrastructure and application-security controls.
Provide architectural oversight and hands-on technical guidance for technologies including Cisco ASA, Cisco Identity Services Engine, Palo Alto Networks next-generation firewalls, F5 BIG-IP, IAM platforms, web application firewalls, and related enterprise security capabilities.
Define reusable security architecture patterns for Azure and AWS, including secure ingress and egress, network segmentation, cloud WAF services, identity integration, certificate management, security logging, and connectivity to enterprise security platforms.
Provide security architecture leadership for the modernization of large-scale WAN and MPLS-based network environments, including segmentation, resiliency, routing, inspection points, traffic flows, availability requirements, and future-state security objectives.
Develop an enterprise strategy for encrypted traffic inspection and TLS decryption at scale. Determine appropriate inspection locations while accounting for security value, application compatibility, privacy, performance, availability, certificate handling, and exception management.
Define and optimize the role of Gigamon and similar network-packet-brokering technologies within the enterprise visibility architecture, including traffic collection points, filtering, replication, optimization, and distribution to SIEM, NDR, threat-hunting, and analytics platforms.
Lead the development of a future-state SIEM, logging, and security-telemetry architecture. Evaluate centralized logging, security data lakes, telemetry pipelines, and platforms such as Cribl while balancing security value, signal quality, scalability, retention, cost, and operational overhead.
Incorporate infrastructure-as-code, policy-as-code, configuration management, version control, automated testing, and repeatable deployment principles into enterprise security architecture and operational patterns.
Develop current-state and target-state architecture diagrams, security reference architectures, technical standards, data-flow diagrams, decision records, implementation guidance, and phased modernization roadmaps.
Communicate complex security architecture concepts, risks, tradeoffs, and recommendations to executive leadership, engineering teams, security operations personnel, application owners, service providers, and other technical and nontechnical stakeholders.

Required Qualifications

Bachelor’s degree in computer science, engineering, information systems, cybersecurity, or a related field, or equivalent professional experience.
Eight or more years of progressive experience in cybersecurity engineering, network security, cloud security, or enterprise infrastructure, including significant responsibility for enterprise-scale architecture and technical design.
Demonstrated experience developing security architectures for large, complex, and distributed organizations spanning on-premises, managed hosting, hybrid, and cloud environments.
Broad knowledge of enterprise security architecture, including network security, cloud security, application delivery, web application protection, PKI, IAM, firewalls, SIEM, security logging, threat detection, and network visibility.
Strong hands-on experience with F5 BIG-IP, including application delivery, load balancing, secure ingress and egress, SSL/TLS services, certificate management, traffic policy, and application-security use cases.
Strong hands-on experience with Cisco ASA, Cisco Identity Services Engine, and Palo Alto Networks next-generation firewalls or comparable enterprise firewall and network access-control technologies.
Strong understanding of enterprise network architecture, including routing, segmentation, MPLS and WAN environments, ingress and egress design, high availability, security service placement, encrypted transport, and traffic-flow analysis.
Experience designing security for externally accessible applications using application delivery controllers, reverse proxies, web application firewalls, edge-security services, DDoS protections, and centralized certificate-management capabilities.
Experience designing security architectures for Microsoft Azure and Amazon Web Services, including cloud networking, identity integration, cloud-native WAF services, logging, segmentation, certificate management, and hybrid connectivity.
In-depth understanding of enterprise PKI, including certificate authority hierarchies, trust models, digital certificates, cryptographic keys, enrollment protocols, revocation, TLS, certificate lifecycle management, and automation.
Experience designing IAM architectures involving authentication, authorization, federation, privileged access, machine identities, workload identities, network access control, and policy-based access enforcement.
Experience assessing and improving enterprise firewall policies, including rule-base analysis, policy rationalization, least-privilege enforcement, application identification, control placement, and reduction of unnecessary rule complexity.
Experience designing SIEM, centralized logging, network detection and response, threat-hunting, telemetry-routing, or security-data architectures.
Understanding of network-packet visibility and traffic-brokering architectures. Experience with Gigamon or a comparable platform is highly desirable.
Experience developing or supporting enterprise encrypted-traffic inspection and TLS decryption strategies.
Familiarity with security data pipelines, observability platforms, data-lake architectures, and telemetry-routing technologies such as Cribl or comparable platforms.
Familiarity with infrastructure-as-code, configuration management, policy automation, version control, and repeatable security deployment practices.
Demonstrated ability to translate cybersecurity strategy, business requirements, and technical risks into practical architectures, standards, implementation plans, and prioritized roadmaps.
Exceptional written and verbal communication skills, with the ability to explain complex architectural concepts and technical risks to both engineering and executive stakeholders.
Demonstrated ability to lead cross-functional initiatives involving infrastructure, network, cloud, application, security operations, vendor, and managed-service-provider teams.
Relevant professional certification such as CISSP, CCSP, SABSA, TOGAF, or an equivalent security, cloud, network, or architecture certification.
Authorization to work in the United States.

Benefits and Perks

Competitive salary, paid biweekly
$100 monthly reimbursement for cell phone and Internet
$3000 yearly training budget
Top-tier medical, dental, and vision insurance coverage
Medical, dental, and vision insurance premiums covered 100% by Foxtrot Division
Unlimited PTO policy including 11 paid holidays
Parental leave
On-the-spot cash awards
Foxtrot Division sponsored events and activities

Originally posted on Himalayas