Principal IT Security Architect - REMOTE from EST or CST

Position Overview

We are looking for a Principal IT Security Architect to shape and lead CNO’s enterprise security strategy, architecture, standards, and approach to securing both existing and emerging technologies. The role defines security requirements, designs, implements, and evaluates security solutions; conducts internal and third‑party security assessments; and develops security policies, standards, and procedures.

• Define complex security architectures for mergers and acquisitions, including leading technology resource decision‑making.
• Analyze and understand the impact of regulation changes on security architecture, standards, and policies, and communicate updates as needed.
• Provide guidance and coaching to cybersecurity leads, senior architects, and engineers; deliver overall technical expertise to the cybersecurity department and business stakeholders.
• Research, model, and track secure system standards, industry trends, market technology, potential threats, tactics, and procedures for reference.
• Develop formal management reporting dashboards aligned to widely accepted standards, including metrics that inform senior leadership on security risk and exposure.
• Effectively communicate risk and mitigation activities to all levels of the organization during incident or risk treatment actions, informing critical decision‑making and delivering risk reductions.
• Identify, quantify, and document requirements to address security risks as they relate to IT and enterprise projects.
• Recognize and identify potential areas where existing security policies and procedures require change or where new ones need development, especially concerning future business expansion.
• Perform third‑party security risk assessments, especially for cloud service providers, and respond to third‑party requests for information on the information security program.
• Ensure the organization leverages proper technologies to meet SOX, PCI, and HIPAA/HITECH compliance requirements.
• Serve as a subject‑matter expert for the incident lead during Incident Response activities.
• Lead matrix working groups during Incident Response activities.
• Support legal and Internal Audit activities and provide information gathering when needed, effectively communicating complex security topics to these teams.

• Demonstrated enterprise‑level expertise across core cybersecurity domains: identity and access management, privileged access management, security operations, incident response, vulnerability management, infrastructure and application security, and business/technology resiliency.
• Deep knowledge of information security regulations, standards, and frameworks such as PCI, SOX, HIPAA/HITECH, OWASP, NIST, ISO 27001, and CMMC.
• Proven experience leading and serving as a subject‑matter expert for security incident response activities, with a working understanding of penetration testing concepts and methods.
• Strong experience across complex enterprise technology environments, including operating systems, networking, storage, identity providers, data center infrastructure, cloud service provider architecture, and mainstream platforms (e.g., Microsoft, Oracle, IBM); able to design secure architectures for new technologies, major system changes, and mergers and acquisitions.
• Knowledge of Artificial Intelligence security concepts, including AI governance, security posture management, common adoption risks, and exploitation methods.
• Ability to influence and collaborate effectively across cybersecurity, IT, business partners, and third‑party vendors while driving urgency when needed.
• Excellent communication of complex technical and security concepts in clear, business‑focused language to audiences ranging from technical teams to senior and executive leadership.

• Bachelor’s degree in Information Technology or a related field of study, or equivalent experience.
• 12 years of progressive IT experience with 5+ years as a security architect or related role.
• Experience implementing and ensuring compliance with DoD STIG, Critical Infrastructure Protection, FedRAMP or other security requirement frameworks or guides.
• Strong ability to apply business…