Security Architect — Cloud, Zero Trust & Compliance

Citigroup; Ciudad de México; Presencial; MXN 1.100.000 - 1.900.000; Jornada completa

Descripción de la vacante

Banamex, part of Citigroup, seeks a Security Architect to define the next generation security fabric for a cloud-first bank transformation. You will design reference architectures, lead threat modeling, and embed zero-trust, identity, and data security across on-prem and cloud workloads.

You will partner with engineers and executives to ensure compliance with CNBV, PCI DSS, and ISO standards while delivering secure, scalable platforms for millions of customers in Mexico.

Formación

• 10+ years in security engineering/architecture in regulated industries (banking/fintech preferred).
• Owned reference architectures and security patterns across cloud + on-prem.
• Depth in identity (OAuth2/OIDC/SAML), IAM/PAM, Zero Trust, and secrets management.
• Practical cryptography (TLS/mTLS, key mgmt, HSM/KMS), data protection, and classification.
• DevSecOps experience integrating SAST/DAST/SCA, container/K8s security, and IaC scanning into pipelines.
• Designed logging/telemetry for SIEM/SOAR with clear detection use cases.
• Proven track translating regulatory requirements into automated, auditable controls.
• Excellent documentation (C4/sequence diagrams) and executive communication.

Responsabilidades

• Target Security Architecture: Define and evolve reference architectures, control patterns, and guardrails for on-prem, cloud (AWS/Azure/GCP), and hybrid environments.
• Design Authority: Lead architecture reviews and formal threat modeling; document risk-based decisions that stand up to audit.
• Zero-Trust & Identity: Drive identity-centric designs (OIDC/OAuth2/SAML, MFA, PAM), workload identity, micro-segmentation, and continuous verification.
• Data Security: Standardize encryption at rest/in transit, KMS/HSM usage, tokenization, data classification, DLP, and secrets management.
• Cloud & Container Security: Patterns for Kubernetes, serverless, and IaC (Terraform); adopt policy-as-code (OPA/Conftest), image signing, and runtime protections.
• DevSecOps Enablement: Embed SAST/DAST/IAST/SCA and IaC scanning into CI/CD; create reusable modules and golden paths developers love.
• Payments & Channels: Architect controls for SPEI/CoDi rails, card issuing/acquiring, mobile/web apps, and open banking APIs.
• Third-Party & SaaS: Intake standards, vendor architecture reviews, compensating controls, and continuous monitoring.
• Detection & Response Architecture: Telemetry standards and use cases for SIEM/SOAR/EDR/NDR aligned to MITRE ATT&CK.
• Compliance by Design: Map controls and evidence to CNBV/Bank of Mexico expectations, PCI DSS, ISO 27001, SOX/GLBA equivalents, and FFIEC-aligned practices.
• Executive Storytelling: Translate technical risk into business impact for the CTO, Architecture Board, and senior leadership.

Conocimientos

Security architecture

Threat modeling

Identity & IAM

Zero Trust

Cryptography

DevSecOps

Logging & SIEM

Regulatory compliance

Executive communication

Herramientas

Terraform

Kubernetes

OPA/Conftest

Descripción del empleo

Banamex, part of Citigroup, seeks a Security Architect to define the next generation security fabric for a cloud-first bank transformation. You will design reference architectures, lead threat modeling, and embed zero-trust, identity, and data security across on-prem and cloud workloads.

You will partner with engineers and executives to ensure compliance with CNBV, PCI DSS, and ISO standards while delivering secure, scalable platforms for millions of customers in Mexico.