Cloud-First Security Architecture Leader

Banamex; México; Presencial; MXN 1.200.000 - 1.900.000; Jornada completa

Descripción de la vacante

Banamex is transforming into a modern, secure, cloud-first financial platform. The Security Architect will report to the CTO and serve as the architectural backbone driving secure banking across on-prem, cloud, and hybrid environments.

Lead threat modeling, Zero Trust, data security, and DevSecOps enablement while embedding compliance by design with CNBV and PCI DSS expectations. You will influence executive decisions and shape the bank's security pattern library across Mexico.

Formación

• 10+ years in security engineering/architecture; 3+ designing enterprise systems in regulated industries (banking/fintech preferred).
• Owned reference architectures and security patterns across cloud + on-prem.
• Depth in identity (OAuth2/OIDC/SAML), IAM/PAM, Zero Trust, and secrets management.
• Practical cryptography (TLS/mTLS, key mgmt, HSM/KMS), data protection, and classification.
• DevSecOps experience integrating SAST/DAST/SCA, container/K8s security, and IaC scanning into pipelines.
• Designed logging/telemetry for SIEM/SOAR with clear detection use cases.
• Proven track translating regulatory requirements into automated, auditable controls.
• Excellent documentation (C4/sequence diagrams) and executive communication.

Responsabilidades

• Define and evolve reference architectures, guardrails for on-prem, cloud (AWS/Azure/GCP), and hybrid environments.
• Lead architecture reviews and formal threat modeling; document risk-based decisions that stand up to audit.
• Drive identity-centric designs (OIDC/OAuth2/SAML, MFA, PAM), workload identity, micro-segmentation, and continuous verification.
• Standardize encryption at rest/in transit, KMS/HSM usage, tokenization, data classification, DLP, and secrets management.
• Patterns for Kubernetes, serverless, and IaC (Terraform); adopt policy-as-code (OPA/Conftest), image signing, and runtime protections.
• Embed SAST/DAST/IAST/SCA and IaC scanning into CI/CD; create reusable modules and golden paths developers love.
• Architect controls for SPEI/CoDi rails, card issuing/acquiring, mobile/web apps, and open banking APIs.
• Intake standards for third-party & SaaS; vendor architecture reviews and continuous monitoring.
• Telemetry standards and use cases for SIEM/SOAR/EDR/NDR aligned to MITRE ATT&CK.
• Compliance by design: map controls to CNBV/Bank of Mexico expectations, PCI DSS, ISO 27001, SOX/GLBA equivalents, FFIEC-aligned practices.
• Executive storytelling: translate technical risk into business impact for CTO and senior leadership.

Conocimientos

Security architecture

Identity & IAM

Cryptography

DevSecOps

Threat modeling

Compliance mapping

Executive communication

Documentation

Descripción del empleo

Banamex is transforming into a modern, secure, cloud-first financial platform. The Security Architect will report to the CTO and serve as the architectural backbone driving secure banking across on-prem, cloud, and hybrid environments.

Lead threat modeling, Zero Trust, data security, and DevSecOps enablement while embedding compliance by design with CNBV and PCI DSS expectations. You will influence executive decisions and shape the bank's security pattern library across Mexico.