Global Cybersecurity Senior Manager – Architecture

Boston Consulting Group; Lisboa; Hybrid; EUR 90,000 - 140,000; Full time

Job summary

Boston Consulting Group seeks a Global Cybersecurity Senior Manager – Architecture to strengthen the firm’s identity security and Zero Trust posture. You will define architecture standards for identity management, oversee cryptographic resilience, and drive automation with engineering teams across Azure, AWS, and GCP.

You will partner with the Secure Identity Engineering Squad and ISRM to deliver secure, scalable identity solutions while guiding architectural risk, governance, and best practices

Qualifications

• 6–10 years of experience in security architecture, infrastructure security, or security engineering.
• Deep expertise in identity security architecture, Microsoft Entra ID, Okta, and enterprise authentication technologies.
• Experience securing human and non-human identities, including service accounts, workload identities, and emerging agentic AI systems.
• Strong knowledge of identity assurance frameworks (NIST SP 800-63, ISO/IEC 24760), Zero Trust architecture (CISA ZTMM), and cloud environments, including Azure, AWS, and GCP.
• Ability to evaluate complex security risks, establish architectural requirements, and guide practical security solutions.
• Demonstrated ability to influence engineering teams, communicate technical decisions, and navigate enterprise security governance.
• Experience collaborating across global technology teams and guiding complex security initiatives through architectural oversight.

Responsibilities

• Define and maintain identity security architecture: Establish and maintain security architecture standards for enterprise identity and access management, including authentication, conditional access, identity governance, and privileged access across BCG’s hybrid technology environment.
• Strengthen identity security controls: Establish architectural requirements for Microsoft Entra ID, Okta, and related identity platforms, including phishing-resistant multifactor authentication, federation, single sign-on, and secure access policies.
• Own cryptographic resilience for identity: Define crypto-agility and post-quantum cryptography (PQC) transition requirements for authentication credentials, certificates, and secrets.
• Advance identity governance and non-human identity security: Define architectural requirements for identity lifecycle management, privileged access, and non-human identities, including service accounts, workload identities, and AI agents.
• Drive automation and policy-as-code adoption: Advance identity security controls, access policy enforcement, drift detection, and automated remediation, partnering with engineering.
• Provide security architecture governance: Conduct security architecture reviews for identity initiatives, issuing dispositions, and architectural decision records; route exceptions through ISRM governance.

Skills

Security architecture

Identity security

Microsoft Entra ID

Okta

Zero Trust

Cloud environments (Azure, AWS, GCP)

Architecture governance

Threat protection

Influence engineering teams

Tools

Azure

AWS

GCP

Job description

Who We Are

Boston Consulting Group partners with leaders in business and society to tackle their most important challenges and capture their greatest opportunities. BCG was the pioneer in business strategy when it was founded in 1963. Today, we help clients with total transformation-inspiring complex change, enabling organizations to grow, building competitive advantage, and driving bottom-line impact. To succeed, organizations must blend digital and human capabilities. Our diverse, global teams bring deep industry and functional expertise and a range of perspectives to spark change. BCG delivers solutions through leading-edge management consulting along with technology and design, corporate and digital ventures—and business purpose. We work in a uniquely collaborative model across the firm and throughout all levels of the client organization, generating results that allow our clients to thrive.

What You\'ll Do

As the Global Cybersecurity Senior Manager – Architecture, you will help strengthen BCG’s global cybersecurity environment by leading security architecture and governance for enterprise identity and access management capabilities. You will define security requirements, establish architectural standards, and guide the design of secure, resilient identity solutions that protect BCG’s people, applications, and infrastructure. Your work will support BCG’s Zero Trust strategy while enabling secure and efficient technology delivery across the firm.

As part of the Infrastructure Security Architecture team within Information Security Risk Management (ISRM), you will serve as a key security architecture partner to the Secure Identity Engineering Squad. You will provide technical direction, architectural oversight, and risk-based guidance throughout the solution lifecycle, working closely with engineering teams responsible for implementation and operations. Through these partnerships, you will help strengthen security practices, resolve complex architectural challenges, and advance enterprise security objectives.

Key Responsibilities

• Define and maintain identity security architecture: Establish and maintain security architecture standards for enterprise identity and access management, including authentication, conditional access, identity governance, and privileged access across BCG’s hybrid technology environment, underpinned by a continuously maintained enterprise identity inventory and cross-domain identity correlation, and developing reference architectures and control requirements aligned with Zero Trust objectives and identity maturity priorities.


• Strengthen identity security controls: Establish architectural requirements for Microsoft Entra ID, Okta, and related identity platforms, including phishing-resistant multifactor authentication, federation, single sign-on, and secure access policies.


• Own cryptographic resilience for identity: Define crypto-agility and post-quantum cryptography (PQC) transition requirements for authentication credentials, certificates, and secrets, including hybrid PQC schemes for privileged and Tier-0/Tier-1 identities to mitigate harvest-now-decrypt-later risk.


• Advance identity governance and non-human identity security: Define architectural requirements for identity lifecycle management, privileged access, and non-human identities, including service accounts, workload identities, and AI agents. Establish security guardrails for authentication, authorization, credential management, and least‑privilege access across human and machine identities.


• Drive automation and policy-as-code adoption: Advance identity security controls, access policy enforcement, drift detection, and automated remediation, partnering with engineering to move identity governance from manual review toward continuous, automated validation.


• Provide security architecture governance: Conduct security architecture reviews for identity initiatives, issuing dispositions, conditions, and architectural decision records; partner with the Secure Identity Engineering Squad and global technology teams across the delivery lifecycle to integrate security requirements and validate control effectiveness through implementation; route exceptions through ISRM governance with documented compensating controls and risk acceptance, escalating unresolved architectural risk through the Infrastructure Security Architecture Lead.


• Strengthen identity threat protection: Define architectural controls to address identity-related threats, including credential compromise, token theft, privilege escalation, and unauthorized access, while partnering with Security Operations on monitoring and detection requirements.


• Define identity telemetry requirements: Establish logging, telemetry, and monitoring requirements for identity services in partnership with Security Operations, which owns SIEM, detection engineering, and continuous monitoring.

What You\'ll Bring

• 6–10 years of experience in security architecture, infrastructure security, or security engineering.


• Deep expertise in identity security architecture, Microsoft Entra ID, Okta, and enterprise authentication technologies.


• Experience securing human and non-human identities, including service accounts, workload identities, and emerging agentic AI systems.


• Strong knowledge of identity assurance frameworks (NIST SP 800-63, ISO/IEC 24760), Zero Trust architecture (CISA ZTMM), and cloud environments, including Azure, AWS, and GCP.


• Ability to evaluate complex security risks, establish architectural requirements, and guide practical security solutions.


• Demonstrated ability to influence engineering teams, communicate technical decisions, and navigate enterprise security governance.


• Experience collaborating across global technology teams and guiding complex security initiatives through architectural oversight.

Who You\'ll Work With

You will work within ISRM’s matrixed environment, partnering with Security Operations, Risk Management, and architecture peers to advance identity-centric Zero Trust maturity.

Additional info

At BCG, our people and relationships are at the heart of everything we do. We believe that in‑person collaboration plays an important role in our culture, mentorship, and professional development. For this role, you will generally be expected to work from a BCG office or in person with clients on a regular basis (typically around 50% of working time), depending on business needs and in line with local policies and practices. We aim to provide a dynamic and collaborative environment that fosters connection and teamwork.

Boston Consulting Group is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, age, religion, sex, sexual orientation, gender identity / expression, national origin, disability, protected veteran status, or any other characteristic protected under national, provincial, or local law, where applicable, and those with criminal histories will be considered in a manner consistent with applicable state and local laws.

BCG is an E - Verify Employer. Click here for more information on E-Verify.