Senior Associate, Security Architect (12-months contract)
Description
Purpose of Role
The Security Architect will be pivotal in collaborating with the Project Management Office (PMO) to advise on and implement best practices in technology solutions. This role is essential in assessing the current technology architecture and working closely with the PMO and other stakeholders to suggest solutions that align with business goals. The Security Architect is a primary source of expertise for the security implications of technological alterations. They will be tasked with guiding the PMO and updating architectural artifacts to ensure the highest standards of security architecture design and implementation are maintained.
Responsibilities & Accountabilities
The key areas of responsibility and accountability include:
Governance
- Assist in maintaining QTC’s Technical Design Principles in line with QTC’s technology strategies, business requirements and the evolution of services in the market.
- Develop and maintain security architecture artifacts (e.g., models, templates, standards and procedures) that can be used to leverage security capabilities in projects and operations.
Strategy and Planning
- Support the Technology, Data and Information team in the creation of Technology and Cyber Security Strategies and Roadmaps to ensure QTC’s technology landscape continues to evolve in line with the market, and the evolving cyber threat landscape is managed.
- Enabling and supporting QTC in developing a mature design culture through collaboration with key business stakeholders.
- Working in collaboration with the business to undertake planning to realise future technology benefits and to ensure existing technology has maximum uptake.
- Track developments and changes in the digital business and threat environments to ensure that they're adequately addressed in security strategy plans and architecture artifacts.
Maintenance and Hygiene
- Have oversight of QTC’s technology and security landscape, its strengths, weaknesses and suggest opportunities for improvements.
- Assist in the development and ongoing maintenance of technical architectural artefacts including information and system architecture.
- Assist in reviewing and maintaining technical design and as-built documentation to ensure it accurately reflects the current state.
- Support the testing and validation of internal security controls, as directed by information security manager / Architect lead or the internal audit team.
- Assess provider’s security certifications (SOC, ISO) for security related deficiencies and report any finding as required.
Design
- Be a key point of reference for cross-system / solution impact of technology changes. This includes providing input into Business Cases and Change Requests, and working with the PMO to ensure all security aspects are considered through the change process.
- Validate IT infrastructure and other reference architectures for security best practices and recommend changes to enhance security and reduce risks, where applicable.
- Validate security configurations and access to security infrastructure tools, including firewalls, IPSs, WAFs and antimalware/endpoint protection systems.
- Conduct or facilitate threat modelling of services and applications that tie to the risk and data associated with the service or application
- Coordinates with DevOps teams to advocate secure coding practices, and to escalate concerns related to poor coding practices.
- Coordinate with the Information Manager to document data flows of sensitive information in QTC (e.g., PII) and recommend controls to ensure that this data is adequately secured (e.g., encryption and tokenisation)
- Reviews network segmentation to ensure least privilege for network access
- Support the Security team with reviewing security technologies, tools and services, and make recommendations to the broader security team for their use, based on security, financial and operational metrics
- Evaluate the statements of work (SOWs) for these providers to ensure that adequate security protections are in place.
Competencies
Technical Competencies
- Proven collaboration and project management skills, particularly in the Information Technology and Data space, including a broad knowledge of best practice standards
- The candidate is expected to have significant experience in a previous role providing cyber security architecture.
- Deep knowledge and experience with security architecture for Azure IaaS and PaaS solutions, including Azure Governance, Security, Identity, Monitoring, and Automation.
- Extensive experience in the application of ICT risk assessment and management processes for complex business environments and supporting ICT infrastructure.
- Experience with ICT vendor service management, SaaS/PaaS/IaaS services, enterprise content management systems, electronic document management systems.
Behavioural Competencies
- Integrity, including upholding strong professional and ethical standards.
- Willingness to accept responsibility and accountability
- A passion for technology, data and innovation, and a forward-thinking approach
- Discretion, maintaining confidentiality, and recognising and respecting sensitivities
- Result-driven individual with an innate ability to remain calm and composed during times of uncertainty and stress
Leadership & Management Competencies
- Demonstrate personal drive, integrity and commitment to achieve results
- Provides technical leadership
- Mentors and coaches project team members and change proponents
Qualifications
Essential
- Requires Tertiary qualification in Information Technology, Computer Science or Computer Engineering or equivalent experience.
Desirable
- Certifications in Azure Architecture highly desired (AZ-305)
- Industry certifications such as TOGAF, CISSP, CCSP, SC-100 and AZ-500
- Experience with the Microsoft Power Platform and Microsoft Dynamics will be well highly regarded
Experience
Essential
- Minimum of 5 years’ experience architecting solutions across complex applications and infrastructure environments including the Microsoft Technology stack.
- Proven experience in the application of technology solutions to business problems in financial organisations.
- Demonstrated knowledge of solution design and architecture skills.
- Strong knowledge and understanding of industry trends and technology.
- Experience in contributing to the development and implementation of new technology systems, processes, and practices
- Experience in reporting and presenting complex technical information to various internal stakeholders.
- Experience in being responsive, adaptive, and agile to changes in direction and approach.
- Technical and architectural expertise in many ICT areas – key areas of interest include zero trust, identity and access management, encryption, network security and secure cloud computing.
- A wide knowledge base over many cyber security disciplines, to engage with in-depth technical resources and gain subject matter expert-specific insights.
Desirable
- Recent experience in assisting with the implementation of Microsoft Azure services, including understanding cost impact in design, would be beneficial.