Network Security Architect

Raise; Calgary; Presencial; CAD 88 000 - 125 000; Tempo integral

Resumo da oferta

Raise is seeking a Network Security Architect to lead design, governance, and roadmap for enterprise network segmentation across on-prem and cloud environments. This role focuses on architecture, standards, and policy frameworks to support Zero Trust initiatives, working with multiple teams to define segmentation principles and security boundaries.

The ideal candidate will have extensive experience in large-scale security architecture, with hands-on expertise in NGFWs, NSX/vDefend, and Azure

Qualificações

• 10+ years of experience in network security architecture, network architecture, or cybersecurity architecture.
• Proven experience designing hybrid cloud and data center security architectures for complex enterprise environments.
• Deep understanding of microsegmentation concepts, application-centric design methodologies, and east-west traffic security models.
• Hands‑on design experience with Palo Alto Networks NGFWs, VMware NSX and/or Broadcom vDefend, and Microsoft Azure networking and security services.
• Excellent documentation skills, including architecture decision records, roadmaps, and governance policies.
• Industry experience in airline, aviation, transportation, or regulated industries is a plus.

Responsabilidades

• Develop enterprise segmentation strategy and multi-year segmentation roadmap.
• Define enterprise security zones, trust boundaries, and segmentation principles across data center and cloud.
• Create future-state network security architecture and reference models.
• Develop and govern policy standards and lifecycle processes.
• Design workload segmentation models and rule management with east-west traffic focus.
• Define Azure segmentation architecture and hybrid security controls.
• Document current-state architecture, perform gap analyses, and prioritize remediations.

Descrição da oferta de emprego

• Pay Rate: $77.49/hour, depending on experience
• Contract: Start Date 2027-01-01 End Date 2027-12-31 (1 Year)

• Pay Rate: $77.49/hour, depending on experience
• Contract: Start Date 2027-01-01 End Date 2027-12-31 (1 Year)
• Location: Calgary, Alberta

Raise is currently hiring a Network Security Architect on behalf of our client. They’re expanding their team to meet growing needs, making this a unique opportunity to work with an industry leader. Our Client, is a major Canadian airline.

Note: The primary pay rate is based on T4 classification; however, we will also consider applications from candidates interested in an INC classification, where applicable.

Description

The Network Security Architect will lead the design, development, and governance of enterprise network segmentation and security policy frameworks across on-premises data centers and cloud environments. In this role, you will establish architectural standards, governance models, and policy frameworks required to support ’s strategic transition toward a Zero Trust architecture.

Working closely with Network Services, Cybersecurity, Infrastructure, Cloud, and Application teams, you will define and document security zones, trust boundaries, communication patterns, and segmentation policies. The primary focus of this role is architecture, design, governance, and multi-year roadmap development rather than day-to-day operational support or hands‑on implementation.

Responsibilities

• Enterprise Segmentation Strategy
• Develop a multi-year segmentation roadmap aligned with enterprise Zero Trust objectives.
• Define enterprise security zones, trust boundaries, and segmentation principles applicable across data center and cloud environments.
• Create future-state network security architecture and reference models.
• Policy Framework Development & Governance
• Define enterprise network security policy standards and establish policy lifecycle governance processes.
• Develop security classification models for applications, data, workloads, and environments.
• Create reusable policy design patterns, design authority documentation, and reference architectures.
• Define review and approval processes for segmentation policies, facilitate architecture design workshops, and produce executive‑level decision records.
• Microsegmentation Architecture
• Design workload segmentation models leveraging VMware NSX / vDefend to control east‑west traffic patterns.
• Create application‑centric segmentation methodologies and define standards for workload grouping, policy inheritance, and rule management.
• Cloud & Hybrid Security Architecture
• Define Azure segmentation architecture, security zoning, and cloud network security guardrails.
• Ensure seamless alignment between data center and cloud‑based security controls, establishing strict security requirements for hybrid connectivity.
• Discovery & Current‑State Assessment
• Assess existing firewall policies and segmentation controls to identify opportunities to reduce complexity and improve policy effectiveness.
• Document current‑state architecture, conduct gap analyses, and produce prioritized remediation recommendations.

Qualifications

• 10+ years of experience in network security architecture, network architecture, or cybersecurity architecture.
• Demonstrated track record of designing large‑scale enterprise segmentation strategies and governance models.
• Proven experience designing hybrid cloud and data center security architectures for complex enterprise environments.
• Technical Expertise
• Deep understanding of microsegmentation concepts, application‑centric design methodologies, and east‑west traffic security models.
• Strong functional and architectural knowledge of Zero Trust architecture principles.
• Hands‑on architectural design experience with:
• Palo Alto Networks Next‑Generation Firewalls (NGFWs)
• VMware NSX and/or Broadcom vDefend
• Microsoft Azure networking and security services (including Azure Firewall)
• Architecture & Documentation Skills
• Strong proficiency in security zoning, trust boundary definition, threat modeling, and risk assessments.
• Proven ability to translate complex business and operational requirements into scalable architectural standards.
• Excellent documentation skills, including executive presentations, Architecture Decision Records (ADRs), roadmaps, and formal governance policies.
• Preferred Qualifications (Nice to Haves)
• Cloud & Advanced Networking: Experience with Azure Landing Zone security architecture, Azure Virtual WAN, Identity‑based segmentation, Software‑Defined Networking (SDN), security automation, policy orchestration, service mesh, workload identity, and container/Kubernetes networking.
• Architecture Frameworks & Certifications: SABSA, TOGAF, CISSP, CCDE, CCIE Security, VMware VCAP‑NV, Palo Alto PCNSC, or Microsoft Azure Security certifications.
• Industry Experience: Background in airline, aviation, transportation, critical infrastructure, or highly regulated industries managing operational technology (OT) alongside traditional IT platforms.
• Additional Requirement: Our client asks that candidates provide 2 Endorsements/References at the time of application: ( this could be a colleague/manager that worked with you on Recent Projects that relate to this role Ask them to provide a Quick Endorsement - testimonial in point form of your accomplishment / value added) to highlight your skills for this role

Looking for meaningful work? We can help!

Raise is an established hiring firm with over 65 years of experience. We believe strongly in making the world a better place through work, which is why we’re a certified B Corporation and donate 10% of our profits to charity.

We strive to build teams that reflect the diversity of the communities we work in. We encourage all qualified applicants to apply, including people from traditionally underrepresented groups such as women, visible minorities, Indigenous peoples, people identifying as LGBTQ2SI, veterans, and people with visible/nonvisible disabilities.

We have a dedicated webpage for accommodations where you can learn more about what we offer and request accommodation: https://raise.jobs/accommodations/

In order to submit candidates for roles, our clients will sometimes require personal information to confirm the identity of applicants and their legal status to work. Raise will never ask you for personal or banking information unless you have been selected for a job. If you are ever unsure about the legitimacy of this or any other Raise job posting (or have any other questions), please contact us at [phone] or [e-mail].

#WES