Security Architect

Smartsuite; Newport Beach (CA); On-site; USD 140,000 - 180,000; Full time

Job summary

Capitolis is seeking a Security Architect to design security controls, patterns and reference architectures that our systems must follow. You will translate policy requirements into technical standards and advise on risk treatment, identity, network, cloud and data protection design.

You will lead threat modeling, review designs and changes, and track architecture exceptions and remediation roadmaps to ensure ongoing control coverage across the technology estate.

Responsibilities

• Define security architecture principles, patterns and reference designs
• Review solution designs, changes and vendors against security standards
• Translate framework and policy requirements into technical controls
• Lead threat modeling and architecture risk assessments
• Advise on identity, network, cloud and data protection design
• Track architecture exceptions and remediation roadmaps
• Keep standards current with emerging threats and technologies

Job description

SmartSuite for the Security Architect

The Security Architect designs the security controls, patterns and reference architectures that systems must follow, reviews solutions and changes against them, and advises on risk treatment. They translate policy and framework requirements into technical standards engineers can build to.

IT service delivery

What you own

The Security Architect designs the security controls, patterns and reference architectures that systems must follow, reviews solutions and changes against them, and advises on risk treatment.

• Define security architecture principles, patterns and reference designs
• Review solution designs, changes and vendors against security standards
• Translate framework and policy requirements into technical controls
• Lead threat modeling and architecture risk assessments
• Advise on identity, network, cloud and data protection design
• Track architecture exceptions and remediation roadmaps
• Keep standards current with emerging threats and technologies

Reporting lines

Who this role reports to, who reports to them, and the peers they work with most.

Reports to

Chief Information Security Officer

Works closely with

• Security Analyst
• IT Compliance Manager
• IT Risk Manager
• Engineering Manager
• Change and Release Manager
• DevOps Engineer

How SmartSuite supports the Security Architect

The Security Architect sets the patterns and reference designs that systems must follow and answers to the CISO and CTO for whether engineering actually builds to them. SmartSuite holds the standards, the exceptions and the reviews as linked records against the CMDB, so control coverage by system is shown rather than asserted.

Own the standards, patterns and exceptions

Reference patterns engineers can be held to

Security standards and reference patterns are kept in the Control Framework & Regulatory Libraries as controls mapped to NIST CSF, ISO 27001 and CIS, so a pattern is a control with a framework reference, not a wiki page nobody can test against.

No exception quietly becomes permanent

Every architecture exception records its owner, expiry date, compensating control and remediation roadmap, and the dashboard shows which are approaching expiry. An exception cannot drift into the permanent estate, because the record will ask about it.

Which pattern is failing in practice

Threats identified in your architecture risk assessments are captured in Cyber Threat Management and linked to the vulnerabilities, incidents and controls that concern them, so the Security Analyst's findings show up against the threat you assessed and root cause analysis tells you which pattern is failing in practice.

Review designs and changes with engineering and change management

Findings recorded against the change, not emailed

Solution designs and significant changes route through security review inside the change workflow, with your findings recorded against the change itself. The Change and Release Manager cannot schedule what you have not cleared, and your findings travel with the CAB record.

Controls mapped to systems, not to diagrams

The asset register and Configuration Management (CMDB) tell you which systems, applications and dependencies a design touches, so review scope is derived from the inventory and controls are mapped to the systems they protect, not to a diagram from last year.

Engineering and DevOps answering in the record

In-record conversations, mentions and emails bring the Engineering Manager and DevOps Engineer into the review where the finding lives, so clarifications, pushback and the agreed fix are on the record and not spread across three channels.

Report coverage and exceptions to the CISO and CTO

Control coverage by system on one dashboard

Review throughput, open exceptions and control coverage by system are live, so the CISO sees where the estate meets the standard and where it does not. Risk-based prioritization ranks the gaps by inherent risk and business dependency.

Framework evidence from the same mapping

Because patterns are controls mapped to NIST CSF, ISO 27001 and CIS, the IT Compliance Manager's framework evidence and the IT Risk Manager's risk linkage come from your mapping. One set of standards serves design review, audit and risk.

Standards kept current with a version history

Standards, tests and documented processes carry version history and audit trails, so when a pattern changes for a new threat or a post-quantum migration, who approved it and what it replaced are recorded. Engineering builds to the current version.

Security. Holds the security standards and reference patterns and tracks architecture exceptions with owners, expiry dates and remediation roadmaps.

Change. Routes solution designs and significant changes through security review with findings recorded against the change.

Asset config. Uses the CMDB and asset register to scope reviews and map controls to systems.

Monitoring event. Links threat modeling outputs to the vulnerabilities and detections that monitor them.

Reporting. Reports review throughput, open exceptions and control coverage by system to the CISO.

Products this role uses most

Cyber Threat Management

Identify and respond to cyber threats with real-time visibility, structured workflows, and integrated risk and incident management.

Vulnerability Management

Identify, prioritize, and remediate vulnerabilities across systems and applications with automated workflows, SLA tracking, and real-time operational visibility.

Control Framework & Regulatory Libraries

Keep controls in one library and map them across frameworks to reduce duplication and enable a test-once, comply-many approach.

Change Management

Plan, approve, and implement changes with workflows, risk controls, and a current view across systems and services.

Post Quantum Security (PQS)

Prepare for quantum threats with a cryptographic inventory, risk assessment, and migration plans tracked across systems and vendors.

Configuration Management (CMDB)

Track systems, applications, and dependencies in a CMDB that feeds incident, change, and service workflows.

Industry reference

NIST SP 800-160 Vol. 1 (systems security engineering), SABSA and the (ISC)2 CISSP architecture domain describe the discipline; ISO/IEC 27001:2022 Annex A 8.27 requires secure system architecture and engineering principles. NIST SP 800-207 defines zero trust architecture, which OMB M-22-09 (January 2022) required civilian agencies to adopt through fiscal 2024, and NIST SP 800-53 Rev. 5's SA-8 lists the engineering principles, threat modeling among them, that federal systems apply. Sector frameworks set the control baselines the architect designs to: NIST SP 800-53 and FedRAMP, PCI DSS v4.0.1 network segmentation, HIPAA technical safeguards, NYDFS and FFIEC requirements in financial services, and DORA and NIS2 in the EU.

Related roles

Chief Information Security Officer

Explore Further

Guides and definitions from the GRC Knowledge Center and the What-is glossary, chosen for this role.

Frequently asked questions

The Security Architect is accountable for the security standards systems are built to: the architecture principles, patterns and reference designs, the review of solution designs, changes and vendors against them, the translation of framework and policy requirements into technical controls, threat modeling and architecture risk assessments, advice on identity, network, cloud and data protection design, and the register of architecture exceptions with their remediation roadmaps. They keep the standards current as threats and technologies change, which now includes post-quantum readiness.

SmartSuite holds the security standards and reference patterns and tracks architecture exceptions with owners, expiry dates and remediation roadmaps, so an exception granted to a project is a record with the person accountable, the date it lapses and the plan to remove it, rather than an email that is forgotten once the project ships. The Security Architect sees every open exception and which are approaching expiry. Control Framework & Regulatory Libraries holds the framework requirements the standards derive from.

Change Management routes solution designs and significant changes through security review with findings recorded against the change, so a design reaches the Security Architect as a review task and the findings, conditions and approval are attached to the change the Change and Release Manager tracks. The Engineering Manager and DevOps Engineer see what was required before the change proceeds. Review throughput and what is waiting on security are visible, which is the usual complaint about architecture review answered.

Configuration Management (CMDB) and the asset register are used to scope reviews and map controls to systems, so when the Security Architect reviews a change or assesses a threat model, the systems in scope, their dependencies and the controls already applied are read from the CMDB. Control coverage by system then becomes a question with an answer: which systems meet the pattern, which carry exceptions and which have not been reviewed. The IT Compliance Manager works from the same mapping.

Cyber Threat Management captures the threats an architecture risk assessment identifies and links each to the vulnerabilities in Vulnerability Management that would realize it and to the incidents and controls that concern it, so a modeled threat is connected to the findings that matter. The Security Architect can show that a modeled threat is either mitigated by design, monitored or carried as an exception. Post Quantum Security (PQS) sits alongside, so the cryptographic transition is planned in the same place as the rest of the architecture roadmap.

SmartSuite reports review throughput, open exceptions and control coverage by system to the CISO, so the Security Architect's report to the Chief Information Security Officer and Chief Technology Officer shows how many reviews were completed and how long they took, which exceptions are open and expiring, and which systems meet the standards. The IT Risk Manager reads the exception list as a source of technical risk. The report is a view of the records, produced when it is asked for.

The current standards and reference patterns, the list of known exceptions with their owners, the CMDB or asset register as it stands and the change process the review attaches to. Standards are loaded as the documents they already are; exceptions become records with expiry dates. New customers can start with SmartSuite Onboarding, a guided four-week program around one or two priority workflows; for an architect the first workflow is the exception register, because that is where the unmanaged risk is, with reviews routed through Change Management once the Change and Release Manager agrees the trigger.