Security Architect

Company Overview

Hexion is a global leader in specialty chemicals, delivering innovative solutions that improve performance, sustainability, and efficiency across industries. Our manufacturing operations span multiple continents, integrating complex Operational Technology (OT) environments with enterprise IT systems and a growing footprint in Microsoft Azure and Amazon Web Services. As the business adopts cloud platforms and artificial intelligence at scale, Hexion is investing in a security architecture function capable of designing defensible systems across every environment we operate — on-premises data centers, public cloud, the plant floor, and the physical perimeter that protects both.

The Security Architect is a senior technical practitioner responsible for designing the security architecture of Hexion’s enterprise environment: on‑premises infrastructure, Azure and AWS cloud platforms, AI and machine learning systems, and the interfaces between enterprise IT, Operational Technology, and physical security systems. This role owns reference architectures, security design patterns, and architectural standards — and holds the authority to review, challenge, and approve designs before they are built.

This is an architecture role, not a compliance role. The successful candidate uses ISO/IEC 27001, 27017, 27018, 42001, and 27019 as the frameworks that shape control selection and design rationale, then works alongside engineering teams to make those controls real in configuration, code, and network design.

• Security is designed into systems at inception rather than assessed after deployment
• On‑premises, Azure, and AWS environments share a coherent identity, network, and data protection architecture
• Cloud services are architected against ISO/IEC 27017 and 27018 expectations for cloud security and PII protection
• AI and machine learning systems are designed with governance and technical controls aligned to ISO/IEC 42001 and recognized AI threat models
• OT and process control architectures are secured in partnership with engineering, informed by ISO/IEC 27019 and IEC 62443
• Physical security systems and controls are treated as part of the security architecture, not a separate discipline
• Architectural decisions are documented, defensible, and traceable to risk

• Design and maintain reference architectures for network segmentation, zero trust access, remote access, and data center security
• Architect identity and access management across Active Directory, Entra , privileged access management, and federation to cloud and SaaS platforms
• Define security architecture standards for endpoints, servers, virtualization, backup, and disaster recovery
• Lead the architectural review function — evaluate new systems, integrations, and infrastructure changes against defined standards and document exceptions with compensating controls
• Design detection and logging architecture in partnership with security operations, ensuring telemetry coverage across on‑premises and cloud estates
• Maintain the enterprise security architecture roadmap, sequencing capability investments against risk reduction

• Architect landing zones, subscription and account structures, network topology, and guardrails for both Azure and AWS
• Design cloud identity architecture — workload identity, federation, conditional access, least‑privilege IAM policy models, and secrets management
• Apply ISO/IEC 27017 cloud security controls to define Hexion’s architectural obligations as a cloud service customer, and where applicable as a cloud service provider
• Apply ISO/IEC 27018 controls for protection of personally…