Security Architect – Zero Trust Architecture

• Security Architect – Zero Trust Architecture
• Charlotte, NC
• Hybrid role (3 days onsite, 2 days remote)
• Pay: $65-$75 per hour
• 12-month contract with strong potential for extension or full-time conversion

Objective:

Lead the design, governance, and adoption of enterprise Zero Trust Architecture (ZTA) aligned to NIST SP 800-207 and organizational security strategy. Define and operationalize a “never trust, always verify” model across identity, devices, networks, applications, and data. Drive the transition from perimeter-based security to policy-driven, risk-aware access controls that enforce least privilege and continuous verification across all enterprise resources.

Key Responsibilities:

 Architecture & Strategy

• Define and maintain the enterprise Zero Trust Architecture (ZTA) reference model, aligned to industry frameworks (NIST SP 800-207, CISA ZTMM) and business priorities.
• Establish target-state architectures and transition roadmaps for Zero Trust adoption across hybrid cloud, SaaS, and on-prem environments.
• Define policy-driven access models leveraging identity, device posture, behavior, and environmental risk signals.
• Align Zero Trust architecture with enterprise security strategy, cloud adoption, and digital transformation initiatives.

Architecture & Governance

• Lead end-to-end architecture reviews ensuring solutions align with Zero Trust principles, including least privilege, continuous verification, and explicit trust evaluation.
• Define and enforce architectural guardrails and secure patterns across identity, network, endpoint, application, and data layers.
• Establish policy decision and enforcement models (PDP/PEP) across enterprise control points (identity providers, gateways, endpoints, network controls).
• Provide governance and oversight for Zero Trust capabilities across business units, platforms, and shared services.

Cross-Domain Integration

• Design integration patterns that unify IAM, endpoint security, network controls, application access, and data protection into a cohesive Zero Trust model.
• Define how identity, device posture, and risk signals drive dynamic access decisions across APIs, applications, and infrastructure.
• Collaborate with domain architects (IAM, Network, Cloud, Endpoint, Data) to ensure consistent enforcement of Zero Trust controls and patterns.
• Enable secure service-to-service and user-to-resource access patterns across distributed architectures (microservices, APIs, SaaS).

Policy, Access & Control Enforcement

• Define enterprise access control strategies including adaptive authentication, conditional access, and fine-grained authorization.
• Establish policy models for user, service, and machine identity access, incorporating RBAC, ABAC, and policy-based access control.
• Define enforcement patterns across gateways, proxies, API layers, and endpoint controls to ensure consistent access decisions.
• Integrate continuous monitoring and feedback loops to adjust access decisions based on real-time risk and context.

Threat Modeling, Risk & Assurance

• Lead threat modeling initiatives focused on lateral movement, identity compromise, session hijacking, and trust boundary violations.
• Define security controls to mitigate Zero Trust-specific attack vectors (credential abuse, privilege escalation, bypass of enforcement points).
• Ensure Zero Trust architecture aligns with regulatory requirements and supports continuous risk reduction and measurable security outcomes.
• Establish metrics and maturity indicators for Zero Trust adoption and effectiveness across the enterprise.

Engineering Enablement & Adoption

• Drive adoption of Zero Trust patterns through reusable architectures, reference implementations, and engineering guidance.
• Partner with engineering, platform, and security teams to embed Zero Trust controls into SDLC, CI/CD, and platform engineering workflows.
• Evaluate and recommend technologies supporting Zero Trust capabilities (identity platforms, ZTNA, microsegmentation, API gateways, endpoint posture).
• Communicate architecture strategy, tradeoffs, and risk posture clearly to engineering, product, and executive stakeholders.

Core Security Domains

·      Identity & Access Management

Authentication, federation, adaptive MFA, conditional access, service-to-service identity, least privilege, and identity governance.

·      Device & Endpoint Security

Device posture, endpoint detection and response (EDR), mobile/device trust, health validation, and enforcement of device-based access conditions.

·      Network Security & Segmentation

Microsegmentation, software-defined perimeters, ingress/egress controls, secure connectivity, and enforcement of network-level policy decisions.

·      Application & API Security

Application access control, API authentication/authorization, secure service communication, token-based access, and policy enforcement at application layers.

·      Data Security

Data classification, encryption, data minimization, access controls aligned to sensitivity, and protection of data across states (in transit, at rest, in use).

·      Visibility, Analytics & Automation

Centralized telemetry, continuous monitoring, behavioral analytics, policy decision support, and automated response and enforcement.

GenAI Security

• Define secure GenAI patterns (LLM access controls, prompt/response handling, RAG security, agent/tooling boundaries).
• Threat model GenAI use cases (prompt injection, data leakage, model extraction/poisoning, unsafe output handling) and define mitigations/testing.
• Set GenAI data governance requirements (sensitive data use, retention, auditability) and vendor/model assurance expectations.

MINIMUM QUALIFICATIONS:

• 7+ years of relevant experience
• Bachelor’s Degree in Computer Science, Information Security, or related field of study or equivalent

PREFERRED QUALIFICATIONS:

• Master’s in Computer Science, Information Security, or related field.
• 5+ years designing or implementing Zero Trust Architecture or similar enterprise security transformation initiatives
• Deep understanding of Zero Trust principles and frameworks (NIST SP 800-207, CISA Zero Trust Maturity Model)
• Strong experience in IAM, authentication/authorization, and policy-based access control models
• Experience with network security, segmentation, ZTNA, and modern connectivity architectures
• Experience with endpoint/device security and integration of device posture into access decisions
• Experience designing secure architectures across hybrid cloud (AWS/Azure), SaaS, and on-prem environments
• Proven experience integrating multiple security domains into cohesive architecture patterns
• Hands-on or architectural experience with technologies such as identity platforms, ZTNA solutions, API gateways, and microsegmentation tools
• Strong experience with threat modeling, architecture reviews, and security risk assessments
• Familiarity with regulatory frameworks (FFIEC, PCI DSS, SOX) and security frameworks (NIST, CIS)
• Demonstrated ability to influence cross-functional teams and drive enterprise adoption of security patterns
• Strong communication and executive presentation skills

#LI-WM1