Mainframe Security Architect

Kyndryl Inc.; Toronto; On-site; CAD 194,000 - 265,000; Full time

Job summary

Kyndryl is seeking a seasoned security architect to lead the design and operationalization of mainframe security solutions for managed-services clients. You will partner with the mainframe consulting team to validate designs and translate recommendations into runbooks, controls, and run readiness plans while guiding delivery teams through design, build, test, pilot, and cutover.

You will provide architecture guidance across IBM Z security domains, support RACF/ACF2/Top Secret, and design

Qualifications

• Strong experience with IBM Z / z/OS security architecture, engineering, or operations.
• Deep hands-on knowledge of RACF, ACF2, or Top Secret/TSS.
• Working knowledge of SAF, ESM integration, dataset security, and privileged access.

Responsibilities

• Lead the architecture and operationalization of mainframe security solutions for managed-services clients.
• Validate designs with the mainframe consulting team and translate recommendations into runbooks and controls.
• Design security patterns for mainframe access paths and workloads (TSO, CICS, Db2, MQ, FTP/SFTP, SSH, JES, SDSF).
• Support integration with MFA, IAM, SIEM/SOC, and compliance processes.
• Define operating models for user enrollment, access reviews, and break-glass procedures.
• Guide delivery through design, build, test, pilot, cutover, and transition-to-run.

Skills

IBM Z / z/OS security

RACF/ACF2/Top Secret

SIEM / SOC integration

RBAC / least privilege

IAM integration

Mainframe security architecture

Tools

zSecure

ACF2

Broadcom Top Secret

JCL / JES2

SailPoint / IAM tools

Job description

Who We Are

At Kyndryl, we run and reimagine the mission‑critical technology systems that drive advantage for the world’s leading businesses. We are at the heart of progress; with proven expertise and a continuous flow of AI‑powered insight, enabling smarter decisions, faster innovation, and a lasting competitive edge. For our people—Kyndryls—that means doing purposeful work that powers human progress. Join us and experience a flexible, supportive environment where your well‑being is prioritized and your potential can thrive.

The Role Key Responsibilities

• Lead the architecture and operationalization of mainframe security solutions for Kyndryl managed‑services clients.
• Work with the Kyndryl mainframe consulting team to validate solutions being designed, proposed, and recommended to clients.
• Translate consulting recommendations into practical managed‑services designs, implementation approaches, runbooks, controls, support procedures, and operational readiness plans.
• Provide architecture guidance across IBM Z security domains, including authentication, authorization, privileged access, dataset and resource protection, audit, monitoring, encryption, compliance, and cyber resilience.
• Support client environments using RACF, ACF2, and Top Secret/TSS.
• Design and validate security patterns for key mainframe access paths and workloads, including TSO, TN3270, CICS, Db2, IMS, MQ, FTP/SFTP, SSH, USS, batch, JES, SDSF, started tasks, service IDs, vendor IDs, automation IDs, and privileged users.
• Support integration with enterprise security capabilities, including MFA, identity lifecycle intelligence and governance, privileged access management, SIEM/SOC monitoring, incident and change management, resilience, and compliance processes.
• Define practical operating models for user enrollment, identity correlation, access reviews, exception handling, break‑glass access, fallback, DR, password/passphrase impacts, monitoring, alerting, reporting, and steady‑state support.
• Guide delivery teams through design, build, test, pilot, cutover, stabilization, and transition‑to‑run.
• Create reusable Kyndryl assets such as reference architectures, discovery questionnaires, implementation checklists, SIEM mappings, exception models, test plans, runbooks, and operational readiness criteria.
• Engage with client security architects and technical stakeholders to confirm that proposed controls are secure, practical, auditable, resilient, and supportable under managed‑services SLAs.

Who You Are Required Skills and Experience

• Strong experience with IBM Z / z/OS security architecture, engineering, or operations.
• Deep hands‑on knowledge of at least one major mainframe External Security Manager: RACF, ACF2, or Top Secret/TSS.
• Working knowledge across mainframe security concepts, including SAF, ESM integration, dataset security, general resource protection, privileged access, started tasks, service accounts, digital certificates, SMF, audit controls, and security administration.
• 10 + years experience securing mainframe subsystems and access paths such as CICS, Db2, IMS, MQ, USS, FTP/SFTP, SSH, TSO, TN3270, batch, JES, and SDSF.
• Experience with mainframe MFA, enterprise IAM integration, identity lifecycle management, access certification, RBAC, least privilege, privileged access, and non‑human identity governance.
• Experience integrating mainframe security with SIEM/SOC processes, including security event forwarding, alerting, monitoring, investigation, and audit reporting.
• Ability to design solutions that account for DR, high availability, fallback, exception handling, performance, password/passphrase policies, operational support, change management, and regulatory auditability.
• Experience in managed services, outsourcing, consulting, financial services, insurance, government, healthcare, or other regulated enterprise environments.
• Strong communication and documentation skills, including architecture diagrams, technical designs, implementation plans, runbooks, risk summaries, and executive‑level updates.

Preferred Skills

• Experience with IBM Z MFA / zMFA, Broadcom Advanced Authentication Mainframe, Rocket MFA, or equivalent mainframe MFA capabilities.
• Familiarity with identity lifecycle intelligence and governance platforms such as SailPoint, IBM Security Identity Governance and Intelligence, IBM Verify Identity Governance, or equivalent client platforms.
• Experience with mainframe security, compliance, monitoring, and resilience tools such as IBM zSecure, Broadcom ACF2, Broadcom Top Secret, Broadcom Compliance Event Manager, Broadcom Trusted Access Manager for Z, BMC AMI Defender, Rocket Secure Host Access, Rocket z/Assure VAP, or equivalent tools.
• Knowledge of RACDCERT, IC SF, AT‑TLS, TLS certificates, dataset encryption, key labels, CKDS/PKDS/TKDS concepts, certificate lifecycle management, and cryptographic controls.
• Experience with mainframe security assessments, audit remediation, CIS/STIG/NIST/SOX/PCI control alignment, pervasive encryption, quantum‑safe encryption readiness, immutable copies, cyber vault, or cyber recovery.
• Working knowledge of JCL, REXX, CLIST, CARLa, TSO/ISPF, SDSF, JES2/JES3, SMF reporting, automation, ServiceNow, Ansible, or Git‑based operational workflows.
• Bilingual English/French is an asset for Canadian client engagements.

Salary: $138,320 - $188,320 The above represents Kyndryl’s pay range for this role. Salaries will vary based on factors such as location, skills, experience, education, and qualifications for the role. The range provided reflects the target compensation range for the position at the time of posting. Kyndryl’s total compensation package will vary based on the pay type of the position and may include performance‑based incentives, discretionary bonuses, as well as other perks and rewards.

Being You

The “Kyn” in Kyndryl means kinship, which represents the strong bonds we have with each other, our customers and our communities. We focus on ensuring all Kyndryls feel included and we welcome people of all cultures, backgrounds, and experiences. Even if you don’t meet every requirement, we encourage you to apply. We believe in growth, and we’re excited to see what you can bring. At Kyndryl, employee feedback has told us that our number one driver of employee engagement is belonging. That sense of belonging — being a valued, respected, trusted member of the team — is fundamental to our culture and fueling great experiences for our customers. This dedication to welcoming everyone into our company means that Kyndryl gives you the ability to thrive and contribute to our culture of empathy and shared success. That’s The Kyndryl Way.

What You Can Expect

Your career with us isn’t just a job—it’s an adventure with purpose. We offer a dynamic, hybrid‑friendly culture that supports your well‑being and empowers you to grow. Our Be Well programs are thoughtfully designed to support your financial, mental, physical, and social health—because we know that when you feel your best, you do your best. From your very first day, you’ll dive into impactful work that powers the systems our customers rely on every day. You won’t just contribute—you’ll make a difference, tackling meaningful projects that sharpen your skills and fuel your growth. We’re here to champion your journey. With powerful tools to chart your career path, personalized development goals aligned with your ambitions, and continuous feedback to keep you inspired and on track, you’ll have everything you need to thrive and evolve. You’ll develop in‑demand skills to grow your career and achieve your ambitions with access to cutting‑edge learning opportunities—from certifications with Microsoft, Google, and Amazon to coaching and hands‑on experiences. And through it all, you’ll be part of a culture that values empathy, restless learning, and a devotion to shared success. We want you to thrive here—and we’re committed to helping you do just that. Ready to make an impact? Join us and help shape what’s next.

At Kyndryl, we achieve progress the world depends on, with purpose. Beginning with the purpose that matters to you. Because here, you will be part of a culture designed with purpose. One that is restless, empathetic and devoted. Where we are committed to sustainable progress for our customers and supporting the communities where we work and live. All of you is what we want. And what we need. Join us, and together, we can advance the vital systems that power human progress.