Sr Lead Cyber Security Engineering

About Northern Trust

Northern Trust is a global leader in innovative wealth management, asset servicing, asset management and banking services. Established in 1889, we have aligned our efforts with our principles of Service, Expertise, and Integrity, serving the world’s most sophisticated clients using leading technology and exceptional service.

We are seeking a highly skilled Tech Lead with deep expertise in security products, authentication, authorization, access management and governance.

• Lead Identity centric Workforce Security solutions team to develop authentication and access management solutions.
• Drive the development of identity solutions, access patterns, modern security protocols, practicing Zero Trust, least privileged and defense‑in‑depth principles.
• Review and provide feedback on Identity and access‑management related security solutions proposed by stakeholders and provide consultation to partners and IT management.
• In‑depth knowledge and experience on Entra , EPM, Sentinel, Azure, AWS, Okta, Ping Federate and entitlement‑management solutions.
• Strong expertise on managing identities in Azure AD with OAuth, OIDC, SAML, SSO, MFA, Conditional Access, Kerberos, LDAP, identity federations, etc.
• Experience providing security solutions for Java‑based microservices, React front‑ends and Android/iOS mobile applications on Azure.
• Hands‑of experience in JWT, session handling, code signing, certificate authentication, TLS/SSL, API security, application registration and integration scenarios.
• Awareness of API management, firewalls, DLP, VPNs, DNS, Azure Defender, MCAS, Sentinel, WAFs, application gateways, NSGs, App Proxy, Radius clusters, CDN, etc.
• Good understanding of Cloud Infrastructure Entitlement Management (CIEM) to remediate toxic combinations and high‑risk entitlements.
• Understanding and application of threat‑modeling concepts and methodologies.
• Knowledge of application security, OWASP standards, security best practices, browser compatibility, and cookie handling.
• Acts as a workforce cybersecurity expert for end‑user computing, proxy solutions, MFA, SSO, conditional access, passwordless, Yubi Key, biometrics, identity and governance scenarios, secrets management, automation, role‑based access control, privileged identity management, just‑in‑time access, etc.
• Participates in solutions supporting token handling, OIDC/OAuth flows, authorization patterns, identity federation, cloud architectures, cryptography, cloud‑native services and cloud security.
• Deeper understanding of cloud security areas such as policies, RBAC, activities, identities and privileged access management.
• Ability to support operations and troubleshoot complex identity scenarios with hands‑on experience on Sentinel/KQL/Audit logs.
• Good understanding of Docker security, container orchestration/Kubernetes.
• Good understanding of AI concepts, patterns and impact on identity and access‑management domain.

• Bachelor’s degree in computer science or a related discipline and experience in information security, or an equivalent combination of education and work experience.
• Deep knowledge of application or infrastructure systems architecture, usually with experience across multiple system technologies.
• Excellent consultative and communication skills, and ability to work effectively with clients, partners and IT management.
• Ten years of experience in an information‑security role.
• Five years of experience as a Tech Lead.
• CISSP, CSSP or cloud‑security certification preferred.
• Strong collaboration skills and analytical ability.
• Certifications on Azure and AWS security preferred.

Salary Range: $114,500 – $194,700 USD. Northern Trust provides a comprehensive benefits package that includes retirement benefits (401k and pension), health and welfare benefits (medical, dental, vision, spending accounts, and disability), paid time off, parental and caregiver leave, life & accident insurance, and other voluntary and well‑being benefits. A discretionary bonus program that may include an equity component is also available.

Applicants must be authorized to work in the U.S. without the need for employment‑based…