It Cloud Security Jr Manager

Aeromexico; Xico; On-site; MXN 1,800,000 - 3,200,000; Full time

Job summary

Banamex is transforming into a modern, secure, cloud-first financial platform. As Security Architect, you will shape the security fabric, defining reference architectures and guardrails for on‑prem, cloud, and hybrid systems while embedding resilience, privacy, and compliance across the product stack.

You will lead architectural reviews, champion threat modeling, and drive identity‑centric designs with strong encryption and DevSecOps integrations, delivering secure banking at scale across Mexico.

Qualifications

• 10+ years in security engineering/architecture, preferably in banking/fintech.
• Owned reference architectures and security patterns across cloud and on-prem.
• Depth in identity (OAuth2/OIDC/SAML), IAM/PAM, Zero Trust, and secrets management.
• Practical cryptography, TLS/mTLS, key management, data protection and classification.
• DevSecOps experience integrating SAST/DAST/SCA into pipelines.

Responsibilities

• Define and evolve reference architectures, guardrails, and control patterns for on-prem, cloud, and hybrid environments.
• Lead architecture reviews and formal threat modeling; document risk-based decisions.
• Drive Zero-Trust and identity-centric designs, workload identity, and micro-segmentation.
• Standardize encryption, KMS/HSM usage, data classification, and secrets management.
• Embed security into DevSecOps pipelines with reusable modules and golden paths.

Skills

Target Architecture & Patterns

Zero-Trust & Identity

Identity & IAM

Data Security & Encryption

Cloud & Container Security

DevSecOps & CI/CD Security

Threat Modeling

Job description

Security Architect - Banamex

Banamex is transforming-and we're doing it from the inside out.

We're rebuilding one of Mexico's most iconic banks into a modern, secure, cloud-first financial platform that moves at fintech speed but with the scale and trust of a national institution.

As our Security Architect , you'll report directly to the CTO and become the architectural backbone of that transformation. Your mission: design the next-generation security fabric that protects millions of customers while empowering engineers to deliver faster, safer, and smarter.

You won't be maintaining controls-you'll be defining what secure banking looks like for the next decade . From Zero Trust architecture and DevSecOps pipelines to SPEI/CoDi payments, cloud workloads, and digital identity , you'll embed resilience, privacy, and compliance into every product we launch.

This is a role for someone who wants to build patterns that outlive them , influence architectural decisions at the highest level, and see their work ripple across the entire Mexican financial ecosystem.

If you want to make impact-not noise-this is where it happens.

What you'll own

• Target Security Architecture: Define and evolve reference architectures, control patterns, and guardrails for on-prem, cloud (AWS/Azure/GCP), and hybrid environments.
• Design Authority: Lead architecture reviews and formal threat modeling (STRIDE/LINDDUN); document risk-based decisions that stand up to audit.
• Zero-Trust & Identity: Drive identity-centric designs (OIDC/OAuth2/SAML, MFA, PAM), workload identity, micro-segmentation, and continuous verification.
• Data Security: Standardize encryption at rest/in transit, KMS/HSM usage, tokenization, data classification, DLP, and secrets management.
• Cloud & Container Security: Patterns for Kubernetes, serverless, and IaC (Terraform); adopt policy-as-code (OPA/Conftest), image signing, and runtime protections.
• DevSecOps Enablement: Embed SAST/DAST/IAST/SCA and IaC scanning into CI/CD; create reusable modules and golden paths developers love.
• Payments & Channels: Architect controls for SPEI/CoDi rails, card issuing/acquiring, mobile/web apps, and open banking APIs.
• Third-Party & SaaS: Intake standards, vendor architecture reviews, compensating controls, and continuous monitoring.
• Detection & Response Architecture: Telemetry standards and use cases for SIEM/SOAR/EDR/NDR aligned to MITRE ATT&CK.
• Compliance by Design: Map controls and evidence to CNBV/Bank of Mexico expectations, PCI DSS, ISO 27001, SOX/GLBA equivalents, and FFIEC-aligned practices.
• Executive Storytelling: Translate technical risk into business impact for the CTO, Architecture Board, and senior leadership.

What makes this opportunity special

• Direct impact at the top: Report to the CTO and shape bank-wide technology strategy.
• National scale: Your patterns secure mission-critical platforms used across Mexico.
• Modernization with purpose: Move fast with strong guardrails-security that accelerates delivery, not slows it.
• Growth & visibility: Present to executive forums, mentor engineers, and build the bank's security pattern library.

What you've done (Required)

• 10+ years in security engineering/architecture; 3+ designing enterprise systems in regulated industries (banking/fintech preferred).
• Owned reference architectures and security patterns across cloud + on-prem.
• Depth in identity (OAuth2/OIDC/SAML), IAM/PAM, Zero Trust, and secrets management.
• Practical cryptography (TLS/mTLS, key mgmt, HSM/KMS), data protection, and classification.
• DevSecOps experience integrating SAST/DAST/SCA, container/K8s security, and IaC scanning into pipelines.
• Designed logging/telemetry for SIEM/SOAR with clear detection use cases.
• Proven track translating regulatory requirements into automated,