Reported successfully

Job Overview:

The Security Architect will shape security architecture across ATOM’s enterprise, telecom, digital, and customer-facing environments. The role may be appointed at Senior Manager or Manager level, depending on experience and capability. This senior role combines technical expertise with leadership, business judgment, financial understanding, and organizational influence. The Security Architect will define security strategies, principles, standards, target architectures, roadmaps, and operating models. The role will guide major investments and lead transformation from assessment through implementation and operational adoption. Key priorities include modernizing secure enterprise access; strengthening privileged and administrative access; improving certificate lifecycle management; enhancing Domain Name System security; and evaluating cloud-delivered, locally operated, managed, and hybrid security capabilities. The role will also assess managed security services and customer-facing offerings aligned with sovereignty, resilience, regulatory, operational, and commercial requirements.

Enterprise Security Architecture

1. Define and maintain ATOM’s enterprise security architecture, principles, standards, reference designs, and multi-year roadmap.
2. Develop target and transition architectures across identity, endpoint, network, infrastructure, cloud, applications, data, telecommunications, and customer services.
3. Align decisions with business priorities, operational needs, regulatory obligations, technology strategy, availability, and customer impact.
4. Review major initiatives and issue clear architecture decisions, requirements, risks, assumptions, and recommendations.
5. Retain architecture accountability through implementation and operational handover.

Secure Enterprise Access

1. Modernize access to enterprise applications, infrastructure, cloud services, telecommunications platforms, and administrative environments.
2. Define coherent architecture for workforce, privileged, third-party, remote, and administrative access.
3. Apply identity verification, device security, least privilege, contextual risk, session control, segmentation, and continuous policy enforcement.
4. Evaluate cloud-delivered, locally operated, managed, and hybrid approaches without dependence on a specific vendor.
5. Develop phased transitions that protect availability and continuity while improving user experience, resilience, sovereignty, efficiency, and cost.

Privileged and Administrative Access

1. Define architecture for privileged identities, separate administrative accounts, controlled administration environments, session management, credential protection, and time-bound access.
2. Establish secure access patterns for infrastructure, network, cloud, database, application, telecommunications, and third-party administrators.
3. Promote approval-based elevation, credential rotation, session monitoring, emergency access, and protection of service and machine identities.
4. Ensure controls are usable, resilient, supportable, auditable, and proportionate to criticality.

Certificate Lifecycle Management

1. Define architecture and operating models for discovering, issuing, renewing, rotating, revoking, monitoring, and retiring digital certificates.
2. Establish ownership and inventory across applications, websites, cloud workloads, network devices, telecommunications platforms, and machine identities.
3. Reduce certificate-related outages and exposure through automation, monitoring, policy enforcement, and accountability.
4. Define standards for certificate authorities, cryptography, key protection, validity, renewal, revocation, and emergency replacement.

Domain Name System Security

1. Define security architecture for internal, external, authoritative, recursive, and cloud-hosted Domain Name System services.
2. Establish controls for domain ownership, administrative access, unauthorized changes, abandoned records, misconfiguration, malicious resolution, tunneling, and abuse.
3. Improve visibility and accountability for domain and subdomain changes across enterprise, digital, cloud, and telecommunications environments.
4. Define resilience, recovery, monitoring, logging, segregation, and change-control requirements.
5. Integrate Domain Name System security with asset management, threat monitoring, vulnerability management, and incident response.
6. Assess Domain Name System protection as an internal capability and potential customer service.

Sovereign and Customer Security Services

1. Assess locally operated managed security services aligned with sovereignty, resilience, regulatory, and customer requirements.
2. Evaluate secure connectivity, internet protection, Domain Name System protection, and Home and Family Security services.
3. Work across Product, Enterprise Business, Consumer Business, Network, Technology, Finance, Legal, Regulatory, Procurement, and Operations.
4. Define service architecture, operating model, boundaries, responsibilities, support, service levels, and data-handling requirements.
5. Determine which capabilities should operate locally and which may use strategic partners.
6. Develop business cases covering demand, investment, operating cost, scalability, pricing, margin, partner dependency, and exit options.
7. Lead controlled pilots before wider adoption or commercial launch.

Financial and Commercial Leadership

1. Develop business cases for major security investments, including costs, resources, benefits, risks, and assumptions.
2. Evaluate total cost of ownership across licensing, infrastructure, integration, migration, support, renewal, staffing, and exit costs.
3. Compare options based on security, resilience, operational impact, financial value, sovereignty, and strategic flexibility.
4. Support budgeting, investment prioritization, sourcing, vendor evaluation, negotiation, and contract review.
5. Challenge proposals that do not align with ATOM’s architecture or long-term interests.
6. Track whether investments deliver intended business, security, operational, and financial outcomes.

Stakeholder Engagement and Transformation

1. Advise executives, business units, technology teams, and governance functions on security architecture.
2. Build alignment among stakeholders with different priorities, budgets, accountabilities, and risk tolerances.
3. Translate technical risks and decisions into clear business, financial, and operational language.
4. Challenge assumptions respectfully, resolve disagreements constructively, and escalate significant decisions with clear options and impacts.
5. Lead initiatives from assessment and business case through design, sourcing, implementation, migration, and operational acceptance.
6. Define scope, responsibilities, dependencies, risks, milestones, outcomes, and success measures.
7. Validate designs through technical assessment, testing, pilots, failure scenarios, and operational-readiness reviews.
8. Ensure implemented capabilities have ownership, support, monitoring, documentation, lifecycle management, and funding.

Risk, Governance, and Capability Development

1. Translate threats, architecture weaknesses, and technical debt into business and operational consequences.
2. Provide risk-based recommendations considering criticality, exposure, data sensitivity, customer impact, and availability.
3. Support exceptions with clear ownership, conditions, compensating controls, review dates, and closure requirements.
4. Ensure architecture supports applicable legal, regulatory, contractual, and internal governance requirements.
5. Use lessons from incidents, testing, assessments, audits, and operational failures to improve priorities.
6. Maintain practical architecture governance and document significant decisions.
7. Lead, mentor, and develop security architects and senior technical specialists.
8. Use specialist partners where needed while retaining internal ownership of strategy and architecture decisions.

​​​​​Education & Experience:

• Bachelor’s degree is not mandatory. A relevant degree in Computer Science, Information Security, Telecom, Engineering, IT, Business Technology, or a related discipline is preferred. Substantial relevant leadership, technical, and architecture experience may substitute for formal qualifications.
• 8+ years of relevant experience across security, architecture, network, identity, infrastructure, cloud, telecom, or related disciplines.
• Senior-level experience or comparable influence, complexity, and accountability.
• Proven experience leading cross-functional security architecture and transformation initiatives from assessment and design through implementation and operational handover.
• Experience developing target architectures, transition roadmaps, standards, operating models, business cases, budgets, and commercial evaluations.
• Strong experience in secure enterprise access, privileged access, identity, network security, cloud security, certificate lifecycle management, or DNS security.
• Experience designing security for on-premises, cloud, hybrid, telecommunications, and customer-facing environments.
• Experience in telecom, critical infrastructure, financial services, managed services, or other highly available environments is strongly preferred.
• Strong knowledge of enterprise security architecture, governance, security design, and risk-based decision-making.

Key Skillsets:

• Good understanding of identity-based access, device security, least privilege, privileged access, network segmentation, cloud-delivered controls, and secure administration.
• Knowledge of digital certificates, cryptographic keys, machine identities, certificate automation, DNS services, domain governance, monitoring, and related threats.
• Understanding of telecom platforms, applications, cloud-native platforms, software delivery, threat prevention, incident response, vulnerability management, and resilience.
• Ability to assess technology and delivery options independently of specific vendors.
• Strong executive communication, presentation, stakeholder influence, negotiation, vendor management, and contract review skills.
• Financial understanding covering business cases, total cost of ownership, investment prioritization, operating costs, partner dependency, pricing, margin, and exit arrangements.
• Strong judgment in balancing security, availability, user experience, delivery speed, sovereignty, efficiency, and cost.
• Experience developing managed or customer-facing security services and mentoring architects or senior specialists is advantageous.
• Senior-level certification in security, architecture, risk, cloud, network or goverance is preferred but not mandatory. Relevant experience may sustitute.