Senior Solutions Architect | SecOps (Remote)

Description

The company provides IT consulting and engineering to help IT leaders gain a competitive edge.

The company is headquartered in Irvine, California, employs more than 1,200 people across the United States, and has field offices in Denver, Indianapolis, Grand Rapids, Lexington, Los Angeles, Louisville, Texas, and San Francisco.

The culture combines startup energy with the stability of a scalable business, with room to grow your career.

This client-facing presales role sits in a security operations practice focused on how AI is changing threat detection and response, and how organizations find, rank, and fix exposure.

You will report to Security Operations leadership and cover endpoint detection and response, SIEM/SOAR, agentic SOC, AI-assisted detection engineering, and AI-ready threat, exposure, and vulnerability management, including CTEM, threat-informed prioritization, attack surface and attack path analysis, and closed-loop remediation validation.

You will also shape reference architectures, offerings, and enablement so regional technical teams can sell and deliver security operations work consistently at scale.

Responsibilities

• Lead the most complex client engagements as the senior architect, covering target-state SOC design, SIEM/SOAR modernization and consolidation, agentic SOC and AI-assisted detection design, and CTEM and vulnerability operations redesign, from discovery through executive readout.
• Assess the client's current state and recommend strategic, tactical, and operational steps, framing detection, response, and exposure in terms of business risk, investment, and operating model for CISO and board audiences.
• Design target-state architectures that bring vulnerability management, external attack surface and cyber asset management, cloud and container posture, identity exposure, and attack path analysis into one prioritized view of risk.
• Set risk scoring, remediation SLAs, and accountability models that blend threat intelligence, EPSS and KEV exploitability evidence, asset criticality, and compensating controls, in a form that client IT, cloud, and application owners will accept and carry out.
• Architect the AI layer of security operations and exposure management, including agentic enrichment and deduplication of findings, automated remediation routing, natural-language executive reporting, and closed-loop validation using breach and attack simulation, penetration testing, and purple-team results.
• Connect detection and exposure work into one threat-informed loop, so exposure context shapes response priorities and detection, incident, and hunting findings reorder exposure priorities.
• Own the data foundation for agentic SOC and exposure workflows: asset inventory and ownership accuracy, normalizing findings across scanners and platforms, and security data pipeline and platform decisions.
• Write and maintain reference architectures, assessment frameworks, and packaged offerings, including SOC maturity and AI-readiness assessment, SIEM/SOAR migration, agentic SOC readiness, and exposure management program design, each with defined scope and a delivery playbook.
• Work with Security Solutions practices, regional teams, Managed Services, and Service Delivery to scope, design, and hand off engagements that can run repeatably without you.
• Build enablement and certification content for regional architects and sellers, including playbooks for EDR migration, SIEM onboarding, and detection content standards, plus opportunity qualification guidance.
• Act as senior technical counterpart to priority security operations partners such as Palo Alto Networks, CrowdStrike, Microsoft, and Google, shaping roadmaps, joint offerings, co-funded enablement, and lab capacity.
• Support account teams on qualified opportunities with solution design, competitive positioning, proposals, SOW creation, and technical validation.
• Provide expertise on AI in security operations, AI-assisted triage, LLM-based detection engineering, agentic workflows, and agent governance, and keep up with the threat landscape, standards, and frameworks.
• Represent the company through speaking engagements, publications, field briefings, and industry events.
• Mentor solutions architects, early-career practitioners, and interns across regions, passing on judgment as well as knowledge.

Requirements

• Bachelor's degree in computer science, cybersecurity or equivalent information security, engineering, or a related discipline from an accredited college or university, or measurable knowledge and experience from industry, military, defense, or government operations.
• 8+ years in security operations, exposure management, or both, with hands-on ownership of detection engineering, SIEM/SOAR content and automation, SOC operations, or enterprise vulnerability and exposure operations, beyond product implementation alone.
• Customer-facing experience in presales, solutions architecture, or technology consulting at a VAR, systems integrator, consultancy, or technology vendor.
• Deep expertise in at least two of: SIEM/SOAR platforms (e.g., Palo Alto Networks Cortex XSIAM, Microsoft Sentinel, Google SecOps, Splunk); endpoint, EDR, or XDR (e.g., CrowdStrike Falcon, Microsoft Defender, SentinelOne); threat, exposure, and vulnerability management including CTEM and attack surface management (e.g., Tenable, Qualys, Rapid7, Wiz, Axonius, XM Cyber, Cymulate); identity and cloud telemetry integration.
• Proven ability to design target-state security operations architectures, including platform consolidation and migration strategy, detection-as-code, exposure-as-code, and SOC and exposure operating models.
• Proven experience designing or running a risk-based vulnerability or CTEM program at enterprise scale, covering asset inventory and ownership, findings normalization across multiple scanners and platforms, threat-informed prioritization, remediation SLAs, and executive exposure reporting.
• Working knowledge of CVSS, EPSS, CISA KEV, and SSVC, and of threat intelligence enrichment, with a clear view of where each is useful and where each misleads.
• Familiarity with attack path analysis, breach and attack simulation, and adversarial validation, and how each should set remediation priority and measure program effectiveness.
• Practical experience building, evaluating, or running AI-assisted security operations and exposure management, with an informed view of what works, what does not yet, and how it should be governed.
• Working knowledge of NIST CSF, MITRE ATT&CK, MITRE D3FEND, ISO 27001, and CTEM-aligned exposure frameworks. Familiarity with OWASP AI, the OWASP Top 10 for LLM Applications, MITRE ATLAS, and the NIST AI Risk Management Framework is a plus.
• Working knowledge of at least one major cloud provider (AWS, GCP, or Azure) and its native security telemetry. Experience with multiple providers is preferred.
• GIAC certifications (GCIA, GCDA, GCFA, GDAT), CISSP, or vendor architecture certifications on the platforms above are highly preferred.
• Experience in incident response, threat hunting, or purple-team detection validation is highly preferred.
• Experience packaging offerings, writing reference architectures, or running technical enablement or certification programs is highly preferred.
• Ability to run workshops, assessments, and executive briefings, and to produce clear, concise reports and recommendations.
• Experience creating and maintaining technical documentation, presentations, plans, and roadmaps.
• Strong executive communication, including explaining complex security operations problems to executives and defending a recommendation under challenge.
• Strong interpersonal, communication, and customer presentation skills are required.
• Self-driven, enjoys hard problems, and is comfortable working directly with customers.
• Highly organized and detail-oriented, with strong time management and the ability to prioritize in a fast-paced, high-volume, changing environment.
• Comfortable juggling multiple shifting priorities and meeting deadlines in an entrepreneurial setting.
• Able to travel roughly 25, 35% when needed and holds a valid driver's license.

Conditions

Remote position.

Travel of roughly 25, 35% when needed.

Estimated pay range of $175,000 to $200,000 USD. Actual pay depends on location, experience, skill set, performance, licensure and certification, and business needs, and the range for other locations may differ.

Variable incentive pay, such as bonuses or commissions, may apply for some positions and is not included in base salary.

Employment decisions are based on qualifications, merit, and business requirements, and demographic information is voluntary and not used in hiring decisions.

Benefits

• Medical, dental, and vision coverage for you and your dependents.
• 401(k) with employer match, 529 college savings plan, health savings account, life insurance, and long-term disability.
• Competitive compensation.
• Access to training and development programs.
• Major offices stocked with snacks and beverages.
• Collaborative culture.
• Generous paid time off and support for work-life balance.