Principal Security Architect

HMA Group Holdings; West Des Moines (IA); On-site; USD 180,000 - 240,000; Full time

Job summary

HMA Group Holdings is seeking a Principal Security Architect to lead enterprise security architecture across data protection, identity, cloud, and Security Operations in West Des Moines. The role blends strategic design with hands-on leadership to reduce risk and enable scalable security solutions.

You will guide data security, identity governance, and cloud security for Azure, AWS, and hybrid environments while aligning with industry standards and regulatory requirements.

Qualifications

• Define and maintain enterprise security architecture, standards, and design patterns.
• Lead data security architecture using Varonis and Microsoft Purview for data discovery, classification, and DLP.
• Design and improve security monitoring, SOC/MDR, SIEM, detection and incident response capabilities.
• Provide architectural leadership across Microsoft Entra ID, Defender XDR, Sentinel, Intune, and Microsoft 365 security.
• Support identity and Zero Trust initiatives, including RBAC, least privilege, Conditional Access, MFA, and privileged access.
• Design secure Azure, AWS, and hybrid environments with guardrails for identity, network, and data protection.
• Partner with technology teams and third-party providers to strengthen prevention, detection, and response capabilities.
• Develop roadmaps and target-state architectures aligned with standards like NIST CSF, ISO 27001, CIS Controls, SOC 2, HIPAA, GLBA, NYDFS.
• Assess new technologies and architectures to identify risks and recommend appropriate security controls.
• Conduct security architecture reviews for new/existing technologies and vendors.

Responsibilities

• Define and maintain enterprise security architecture, standards, and design patterns.
• Lead data security architecture using Varonis and Microsoft Purview, including data discovery, classification, and DLP.
• Design and improve security monitoring, SOC/MDR, SIEM, detection, and incident response capabilities.
• Provide architectural leadership across Microsoft Entra ID, Defender XDR, Sentinel, Intune, and Microsoft 365 security.
• Support identity and Zero Trust initiatives, including RBAC, least privilege, Conditional Access, MFA, and privileged access.
• Design secure Azure, AWS, and hybrid environments, establishing guardrails for identity, network, application, and data protection.
• Partner with technology teams and third-party security providers to strengthen prevention, detection, and response capabilities.
• Develop roadmaps, and target-state architectures aligned with business objectives, emerging risks, and with standards (NIST CSF, ISO 27001, CIS Controls, SOC 2, HIPAA, GLBA, NYDFS).
• Assess new technologies, applications, projects, and architectures to identify risks and recommend appropriate security controls.
• Conduct security architecture and technical design reviews for new/existing technologies and vendors, recommending solutions that reduce risk and improve security.
• Attend team and enterprise meetings, as well as leadership training opportunities offered internally and externally.
• Provide backup assistance for team members, as necessary.
• Manage special projects and other duties as assigned.

Skills

Enterprise security architecture

Zero Trust

Data security & DLP

Identity & access management

Cloud security

Threat detection & IR

Security operations

MITRE ATT&CK

Tools

Varonis

Microsoft Purview

Microsoft Entra ID

Defender XDR

Sentinel

Job description

Job Description:

We are looking to add a Principal Security Architect to join our Information Security team in West Des Moines, Iowa . Offering a forward-thinking, innovative, and vibrant company culture, along with the opportunity to share your unique potential, there really is no place like Holmes!

The Principal Security Architect is a senior technical leader responsible for designing and advancing enterprise security architecture across data protection, Microsoft security technologies, identity, cloud, and Security Operations. This role combines strategic architecture with hands-on technical leadership to reduce risk and implement scalable security solutions.

Essential Responsibilities:

• Define and maintain enterprise security architecture, standards, and security design patterns.
• Lead data security architecture using Varonis and Microsoft Purview, including data discovery, classification, sensitivity labeling, access governance, and DLP.
• Design and improve security monitoring, SOC/MDR, SIEM, detection, and incident response capabilities.
• Provide architectural leadership across Microsoft Entra ID, Defender XDR, Sentinel, Intune, and Microsoft 365 security.
• Support identity and Zero Trust initiatives, including RBAC, least privilege, Conditional Access, MFA, and privileged access.
• Design secure Azure, AWS, and hybrid environments, establishing guardrails for identity, network, application, and data protection.
• Partner with technology teams and third-party security providers to strengthen prevention, detection, and response capabilities.
• Develop roadmaps, and target-state architectures aligned with business objectives, emerging risks, and with NIST CSF, ISO 27001, CIS Controls, SOC 2, HIPAA, GLBA, and NYDFS requirements.
• Assess new technologies, applications, projects, and architectures to identify risks and recommend appropriate security controls.
• Conduct security architecture and technical design reviews for new/existing technologies and vendors, recommending solutions that reduce risk, improve security capabilities, and support operational efficiency.
• Attend team and enterprise meetings, as well as leadership training opportunities offered internally and externally.
• Support and maintain standardized processes to ensure efficient and effective quality service according to established quality guidelines.
• Provide backup assistance for team members, as necessary.
• Manage special projects and other duties as assigned.

Knowledge, Skills, and Abilities:

• Strong knowledge of enterprise security architecture principles, including security patterns, reference architectures, defense-in-depth, and Zero Trust.
• Strong understanding of security threats, vulnerabilities, attack techniques, and control frameworks, including MITRE ATT&CK, and the ability to incorporate them into secure architecture and design.
• Strong understanding of Security Operations architecture, including SOC/MDR, SIEM, security telemetry, threat detection, and incident response integration.
• Strong knowledge of identity and access architecture, including RBAC, least privilege, MFA, privileged access, identity governance, and Zero Trust principles.
• Strong knowledge of cloud and hybrid security architecture, including identity, network, application, workload, and data protection controls.
• Strong understanding of data security architecture, including data classification, encryption, DLP, access governance, and protection of sensitive information.
• Demonstrated ability to design, evaluate, and guide implementation of enterprise security architectures across cloud, identity, data, applications, infrastructure, and Security Operations.
• Knowledge of recognized security and compliance frameworks such as NIST CSF, CIS Controls, ISO 27001, SOC 2, HIPAA, and GLBA.
• Strong communication and collaboration skills with the ability to translate complex technical risks and architectural decisions into clear business recommendations.
• Ability to evaluate solution architectures, identify security gaps, and recommend practical controls and remediation strategies.
• Ability to translate technical security risks and architectural decisions into clear, business-focused recommendations for technical teams and leadership.
• Ability to establish security architecture standards, guardrails, and technical direction while influencing cross-functional teams without direct authority.
• Strong ability to collaborate with security, infrastructure, cloud, application, data, and business teams to embed security into technology designs and strategic initiatives.
• Ability to be available for work on a daily basis and extended hours as necessary.
• Ability and willingness to consistently participate in internal and external educational opportunities to enhance knowledge of current insurance topics or relevant system improvements.
• Ability and willingness to pursue relevant designations and/or continuing education, as appropriate.
• Ability to apply common sense understanding to carry out instructions