Principal, Security Engineering and Operations

Description

The company is a global wealth management, asset servicing, asset management and banking firm listed on Nasdaq, serving individuals, families, corporations and institutions worldwide.

Founded in 1889, it has more than 135 years of financial experience and over 24,000 employees, whom it calls partners. Its operating principles are service, expertise and integrity.

The Security Platform Engineering and Operations team protects the company's people, clients, applications, networks, infrastructure and emerging AI workloads by building and running enterprise security at scale.

The company works in a highly regulated environment, so the team puts audit-ready execution, operational resilience and measurable risk reduction first.

This is a senior individual contributor and technical lead role that goes beyond hands-on administration. You will set technical direction, define lasting engineering patterns, mentor engineers, influence partners across functions and make sure platforms meet the reliability, evidence and control standards of a regulated financial institution. It suits someone who can move between executive risk discussions, architecture decisions and deep troubleshooting.

Responsibilities

• Act as the technical authority for security platform engineering decisions and operational governance.
• Design, build and operate zero-trust, SASE/SSE, network, vulnerability and exposure management, AI guardrail and SaaS security tools.
• Set engineering patterns, implementation standards and operational runbooks so business units and technology teams adopt them consistently.
• Create maturity models and metrics that show assurance and compliance levels.
• Align security initiatives across engineering, infrastructure and application teams.
• Engineer, coordinate and run intrusion prevention on next-generation firewalls, vulnerability scanning and the unified vulnerability management (UVM) layer, enterprise SASE/SSE platforms, secure web gateway, CASB and cloud access protection, SaaS protection and monitoring, secure remote access and internet traffic inspection, browser isolation and modern web threat prevention, AI gateway controls that govern how users and applications use LLMs and AI services, and ServiceNow integrations for Vulnerability Response, ITSM and CMDB.
• Own outcomes for platform health, upgrades, capacity, resilience, lifecycle management and vendor escalations across the stack.
• Define and publish metrics on coverage, control effectiveness, SLA adherence, tool health, control performance and measurable risk reduction.
• Support audits and regulatory exams (PCI-DSS, SOX, GLBA, OCC/FFIEC) by designing controls for evidence quality, traceability and repeatable operation.
• Write runbooks and executive-level documentation for engineering, operations, risk and audit stakeholders.
• Lead evaluation of new capabilities, proofs of concept and tool rationalization, recommending based on risk reduction, operational fit, cost and control outcomes.

Requirements

• Typically 15+ years in information technology, cybersecurity, cloud, infrastructure, network security or platform engineering, with proven ownership of enterprise-scale security platforms.
• Track record leading as a senior technical lead: setting direction, influencing without direct authority, mentoring engineers and balancing security, reliability, usability and compliance.
• Deep hands-on experience with at least one SSE/SASE platform, covering ZTNA, secure web gateway policy, segmentation, connector architecture and operating model design.
• Working knowledge of IPS and next-generation firewall platforms, including signature tuning.
• Solid networking fundamentals: TCP/IP, routing, DNS, TLS/PKI, proxies, tunneling (IPsec/GRE) and segmentation.
• Experience with vulnerability management tooling.
• Familiarity with identity integration: SAML/OIDC, Entra ID and conditional access.
• Scripting and API skills in Python, PowerShell and REST/JSON.
• Experience connecting security tools with ServiceNow, SIEM platforms and enterprise reporting workflows.
• Strong communication: briefing senior stakeholders, documenting technical decisions, supporting audit inquiries and aligning teams you do not manage.
• Experience in a regulated environment handling control evidence, operational resilience, risk acceptance, issue management and audit or regulatory response.
• Exposure to AI/LLM security controls, including AI gateways, prompt-injection defenses, OWASP Top 10 for LLM Applications and MITRE ATLAS.
• ServiceNow Vulnerability Response or USEM implementation experience.
• Low-code automation or Terraform/IaC skills.
• Prior experience in financial services, banking, asset servicing, wealth management or another highly regulated industry.

Conditions

Base pay range: $137,400 - 233,600 USD. This range is a good faith estimate of base pay.

You must be authorized to work in the U.S. without employment-based visa sponsorship now or in the future. The company will not sponsor U.S. work visa status for this role, including H-1B, L-1, TN, O-1, E-3, H-1B1, F-1, J-1, OPT, CPT or any other employment-based visa.

Benefits

• Retirement benefits, including a 401k and pension.
• Health and welfare benefits: medical, dental, vision, spending accounts and disability.
• Paid time off, parental and caregiver leave, life and accident insurance, and other voluntary and well-being benefits.
• A discretionary bonus program that may include an equity component.
• Internal moves are encouraged, senior leaders are accessible, and the company has a long record of financial strength and stability.
• Employees worldwide give time and talent to community causes, and giving is a long-standing part of the company's history.