Lead Cybersecurity Architect

Description

The company is a Fortune 10 business in healthcare, known for insights, products and services that make quality care more accessible and affordable.

This Lead (P4) role sits in the medical-surgical distribution unit, which supplies products, pharmaceuticals and diagnostic equipment to non-hospital care settings such as physician offices, surgery centers, long-term care, laboratories and home health. The unit is expected to be renamed in early 2027 and has about 8,000 employees, 15 distribution centers, around 900 delivery vehicles, more than 2,200 manufacturer partners, over 200,000 customer accounts across the U.S., and more than 270,000 SKUs.

You will set and update the unit's security architecture, patterns and guardrails so the business stays protected while moving quickly. You will work with the CISO, senior technology leadership, audit and compliance, product owners, infrastructure, and security engineering and operations. You will advise on current security issues, watch where threats and technology are heading, think like an attacker, turn business goals into architecture decisions, and define target-state designs and roadmaps. You lead through influence, with no direct reports, and you will document and drive adoption of decisions across delivery teams.

Responsibilities

• Maintain and improve reference patterns and guardrails for cloud, network, identity, endpoint, application and data protection, so designs are secure and compliant by default.
• Run architecture reviews for major initiatives such as new platforms, large applications, third-party integrations and B2B/B2C capabilities, recording decisions, risks, exceptions and compensating controls.
• Turn policy, risk and regulatory obligations into engineering requirements, reusable standards and implementation guides such as templates, runbooks and secure reference builds.
• Set target-state security architecture and roadmaps, and align security, technology and business stakeholders on priorities.
• Build security into delivery pipelines by advising on CI/CD controls, infrastructure-as-code, policy-as-code, secrets management and secure SDLC, and help engineers automate with less friction.
• Define measurable outcomes such as guardrail coverage, fewer high-risk exceptions, control adoption and better detection and response, and use them to guide improvement.
• Mentor architects and engineers, and critically review deliverables yourself and with peers.
• Design and maintain cloud security patterns and guardrails covering privileged access, organization policies, network segmentation, encryption and key management, logging, vulnerability and posture management, with clear guidance for delivery teams.
• Perform other duties as assigned.

Requirements

• 8 to 12+ years in cybersecurity, with 5+ years in security architecture including risk management and compliance.
• A record of leading complex initiatives, building alignment, coaching others and delivering measurable security results.
• Strong background designing, implementing and delivering cloud, network, identity, endpoint and application platforms, turning business needs into secure reference architectures and practical plans.
• Deep expertise in IAM including privileged access, network security, encryption and key management, secrets management, application security, vulnerability management, logging and monitoring, and posture management across public cloud and hybrid environments.
• Able to explain technical risk and trade-offs in business terms, influence decisions at many levels, and bring security, engineering and business teams to productive outcomes.
• Experience improving detection and response at scale with SIEM, EDR/XDR, SOAR and threat intelligence, and driving architectural fixes from incidents and post-incident reviews.
• Able to define and run security standards, patterns, guardrails and exception processes, and drive adoption through reviews, coaching, documentation and automation.
• Act with integrity, curiosity and adaptability, and hold a high bar for quality through critical self-review and peer review.
• Hands-on scripting and infrastructure-as-code with Bash, Python or PowerShell, plus policy-as-code.
• Experience designing for cyber resilience, including disaster recovery, business continuity, secure backup and restore, and ransomware recovery.
• Working knowledge of frameworks and regulations such as NIST, ISO 27001, HITRUST, HIPAA/HITECH, PCI DSS, SOX, GDPR and SOC 2.
• Working knowledge of Windows, Linux and container platforms such as Kubernetes, and of modern patterns like API integrations, microservices and serverless.
• Strong strategic and tactical decision-making, weighing trade-offs, defining compensating controls and driving decisions to closure.
• Experience working with offensive and defensive teams, such as through purple teaming, to validate controls and turn findings into architecture changes.
• Highly trustworthy, leading by example and building credibility through consistent follow-through and high-quality work.
• Bachelor's degree in computer science, information security or assurance, MIS, engineering or a related field, or equivalent practical experience.
• 5+ years of hands-on security architecture work, including reference architectures and guardrails, and driving their adoption across several teams.
• Experience designing controls for sensitive data (PII/PHI) and supporting audits with strong documentation and evidence-based controls.
• Zero Trust and IAM/PAM design at scale for workforce and customer identity, including enterprise guardrails, policy-as-code and standard identity and network patterns.
• Proven stakeholder leadership: leading planning and architecture discussions, incorporating reviewer feedback, and securing alignment and approval for secure solutions.
• Experience with modern security platforms and automation, such as SIEM, EDR/XDR, SOAR, secrets management and data protection, plus scripting to scale controls.
• CISSP required.
• Preferred: CISM, GIAC/SANS certifications, and/or relevant cloud security certifications.
• A plus: Google Cloud Professional Cloud Security Engineer and/or Associate Cloud Engineer, Google Professional Cloud DevOps Engineer, and/or GIAC certifications such as GSEC or GCIH depending on focus, and/or cloud or security engineering certifications matching the team's platforms.

Conditions

Base pay range is $122,000 - $203,400.

Pay is set by performance, experience and skills, equity, periodic market reviews and geographic market, and will always comply with applicable regulations.

Annual bonus or long-term incentive opportunities may be offered in addition to base pay.

The company is an equal opportunity employer.

Benefits

• A competitive compensation package under the company's Total Rewards program.