Security Architect

Belcan; Sterling (VA); On-site; USD 160,000 - 175,000; Full time

Job summary

Belcan is seeking a Security Architect to oversee cloud security, governance, and compliance across Azure, GCC High, and CGS SaaS platforms. You will align security standards with CMMC, NIST SP 800-171, DFARS, and ISO 27001, driving secure designs and continuous improvement.

The role partners with IT, Security, Cloud Engineering, Quality, Compliance, and business stakeholders to implement secure solutions, lead audits, and mentor teams in best practices.

Qualifications

• 5–8+ years of experience in cloud security architecture or engineering.
• Experience with Azure security services: Defender for Cloud, Sentinel, Key Vault, Policy, Purview.
• Demonstrated involvement in audits: CMMC, ISO 27001, SOC 2, or similar.
• Knowledge of secure cloud governance, baselines, and policy automation.
• Understanding of cloud IAM, Zero Trust, least privilege, and privileged access management.
• Automation of controls/workflows using tools like ServiceNow.
• Excellent documentation, communication, and cross-functional collaboration skills.
• Availability for after-hours maintenance and incident response.

Responsibilities

• Provide security oversight in Azure Monitor, Defender for Cloud, and SIEM integrations.
• Develop and maintain CGS security standards for GCC High, Azure, and SaaS apps.
• Manage Security and Compliance Centre/Portal in Microsoft 365 GCC High.
• Lead TRB security architecture reviews for cloud/SaaS solutions involving CUI/PII data.
• Evaluate new Microsoft 365 GCC High features for security and CUI impact; partner on secure adoption.
• Serve as the security architecture SME for CGS cloud and SaaS platforms.
• Support audits for frameworks like CMMC, ISO 27001, SOC 2 through documentation and controls.
• Act as ISMS Manager for ISO 27001, ensuring risk management and compliance.
• Guide ISO 42001 AI Management System adoption.
• Produce architecture diagrams and secure design patterns for teams.
• Mentor teams in cloud security best practices and regulatory expectations.

Skills

Azure security

Zero Trust

IAM

Automation

Security governance

Documentation

Cross-functional collaboration

Tools

Defender for Cloud

Sentinel

Key Vault

Azure Policy

Purview

Azure Monitor

SIEM

Job description

Reporting to the CGS IT and Compliance Leads, the Security Architect provides security architecture, governance, and compliance oversight across Microsoft Azure, Microsoft365 GCC High, CGS SaaS applications, and enterprise cloud platforms. The role establishes security standards, assesses technology risks, supports CUI protection, and ensures alignment with applicable requirements including CMMC, NIST SP 800-171, DFARS, ISO 27001, SOC 2, FedRAMP, and ISO 42001. The Security Architect partners with IT, Security, Cloud Engineering, Quality, Compliance and business stakeholders.

Job Duties:

Key Responsibilities:

Cloud, SaaS, and Enterprise Application Security Architecture Responsibilities:

• Provide security oversight in Azure Monitor, Defender for Cloud, and SIEM integrations.
• Develop and maintain CGS security architecture standards and configuration baselines for Microsoft 365 GCC High, Azure, SaaS applications, and other CGS enterprise cloud platforms.
• Manage and maintain the Security and Compliance Centre/Portal in Microsoft 365 GCC High to track postures for different frameworks.
• Conduct and present in TRB security architecture reviews of new and existing cloud/SaaS solutions, integrations, significant changes, and new functionality involving CUI, PII, or other sensitive data.
• Evaluate new Microsoft 365 GCC High features and capabilities for security, compliance, architecture, and CUI impact, partnering with the CGS GCCH Cloud Engineer on secure implementation and adoption.
• Serve as the security architecture subject matter expert for CGS cloud and SaaS platforms

Compliance Responsibilities

• Support CMMC, ISO 27001, SOC 2, and related compliance audits through architectural evidence, documentation, and control validation.
• Stand in as the ISMS Manager for ISO 27001, ensuring documentation, risk management, and ongoing compliance.
• Assess and design Controlled Unclassified Information (CUI) security and data flows designs ensuring alignment with DFARS and CMMC requirements.
• Initiate and guide the organization’s adoption of the ISO 42001 AI Management System framework.
• Produce clear architectural documentation, diagrams, and secure design patterns for use across teams.
• Provide subject matter expertise on cloud security architecture, Azure governance, and secure cloud operations to inform proposal solutions.

Cloud Security Assessments & Reviews

• Cloud security assessments, security reviews and gap analysis
• Drive policy compliance for cloud instances of enterprise systems through continuous monitoring and automated enforcement by compliance monitoring and reporting across cloud environments.
• Guide the implementation of cloud security services (IAM, encryption, logging, SIEM)
• Ensure documentation of security standards, policies, and procedures.
• Serve as a SME during audits and customer assessments.
• Mentor teams in cloud security best practices and regulatory expectations.

Proposal & SCRM Support

• Translate security requirements (CMMC, ISO 27001, SOC 2, DFARS/CUI, FedRAMP) into clear, compliant proposal narratives.
• Collaborate with capture, proposal management, IT, and Security teams to validate approach, commitments, and deliverables.
• Contribute SCRM insights including supplier assessment approaches, vendor vetting, secure procurement processes, and alignment with NIST 800‑161 standards.

Required Qualifications:

• 5–8+ years of experience in cloud security architecture or engineering.
• Strong hands‑on expertise in Azure security services including Defender for Cloud, Sentinel, Key Vault, Azure Policy, Purview, and networking controls.
• Demonstrated experience supporting audits for frameworks such as CMMC, ISO 27001, SOC 2, or similar.
• Knowledge of secure cloud governance, configuration baselines, and policy-driven automation.
• Understanding of cloud IAM, Zero Trust architecture, least privilege, and privileged access management.
• Experience automating controls, workflows, and processes using tools like ServiceNow.
• Excellent documentation, communication, and cross-functional collaboration skills.
• Availability to support scheduled after hours maintenance windows, urgent security events, and high-priority incident response.

Preferred Qualifications & Skills:

• Azure Solutions Architect Expert or Azure Security Engineer (AZ‑500).
• Certifications such as CISSP, CCSP, CISM, ISO 27001 Lead Implementer/Auditor.
• Familiarity with NIST, CIS Benchmarks, DFARS/CUI handling requirements, and emerging ISO 42001 controls.
• Experience with SaaS security architecture and integrations with SIEM and monitoring platforms.

Compensation:

We provide a competitive pay and benefits package. This position is offering a salary range of $160,000- $175,000/year. Belcan considers several factors when extending an offer, including but not limited to education, experience, geographic location, and discipline. Benefits offered may include health care, dental, vision, life insurance; 401(k); education assistance; paid time off including PTO, holidays, and any other paid leave required by law.

www.belcan.com

Belcan is an equal opportunity employer. Your application and candidacy will not be considered based on race, color, sex, religion, creed, sexual orientation, gender identity, national origin, disability, genetic information, pregnancy, veteran status or any other characteristic protected by federal, state or local laws.