The Sr. Security and Compliance Cloud Architect is responsible for working across internal stakeholders and product engineering teams to define and implement best practice implementation of public cloud Infrastructure as a Service (IaaS) to support major industry certifications and authorizations with an emphasis on FedRAMP. Responsibilities include:
Skills and competencies Five or more years' experience in:
- Design, build and implement enterprise-class security systems for a production environment
- Align standards, frameworks and security with overall business and technology strategy
- Identify and communicate current and emerging security threats
- Design security architecture elements to mitigate threats as they emerge
- Create solutions that balance business requirements with information and cyber security requirements
- Identify security design gaps in existing and proposed architectures and recommend changes or enhancements
- Work with internal engineering teams to identify gaps and develop recommendations for addressing gaps to meet FedRAMP moderate baseline control requirements
- Train users in implementation or conversion of systems
Experience with and knowledge of:
- Security architecture, demonstrating solutions delivery, principles and emerging technologies - Designing and implementing security solutions. This includes continuous monitoring and making improvements to those solutions, working with an information security team.
- Consulting and engineering in the development and design of security best practices and implementation of solid security principles across the organization, to meet business goals along with customer and regulatory requirements.
- Security considerations of cloud computing: They include data breaches, broken authentication, hacking, account hijacking, malicious insiders, third parties, APTs, data loss and DoS attacks.
- Identity and access management (IAM) - the framework of security policies and technologies that limit and track the access of those in an organization to sensitive technology resources.
General skills include:
- Deep experience NIST SP 800 Series, FedRAMP and FISMA
- Familiarity with technical security controls and concepts from The DoD Cloud Computing Security Requirements Guide (SRG)
- Experience and familiarity with cloud data security (FISMA/FedRAMP compliance) and working with public cloud solutions (AWS, Google, and Azure)
- National Institute of Standards and Technology (NIST) standards
- ISO27001 - specifications for a framework of policies and procedures that include all legal, physical and technical controls involved in an organization's risk management
- Control Objectives for Information and Related Technologies (COBIT)
- Exceptional communication skills with diverse audiences - Strong critical thinking and analytical skills
- Strong leadership, project and team-building skills, including the ability to lead teams and drive projects and initiatives in multiple departments
- Demonstrated ability to identify risks associated with business processes, operations, information security programs and technology projects
- The ability to be the enterprise security subject matter expert who can explain technical topics to those without a technical background
- Certified Information Systems Security Professional (CISSP)
- Certified Information Security Manager (CISM)
- Certified Information Systems Auditor (CISA)
- Information Systems Security Architecture Professional (ISSAP)
- Information Systems Security Engineering Professional (ISSEP)
Knowledge, experience and subject matter expertise in the following:
- FedRAMP (Federal Risk Authorization Management Program)
- NIST SP 800-53 Rev 4
- NIST SP 800-37
- FISMA (Federal Information Systems Management Act)
- NIST RMF (Risk Management Framework)
- Supporting Systems Security Assessment and Authorization (SA&A) for Federal Agencies
- NIST FIPS 199, Data Classification
- Privacy Impact Assessment (PIA)
- DHS Continuous Monitoring Program
- Minimum BS degree in Computer Science, Electrical Engineering or related fields
Symantec is an equal opportunity employer. All candidates for employment will be considered without regard to race, color, religion, sex, gender identity, sexual orientation, national origin, physical or mental disability, veteran status, or any other basis protected by applicable federal, state or local law.
A little about us:
Join the leader in cyber security. At Symantec, you will make the world a safer place by helping people, businesses, and governments protect and manage their information so they can focus on achieving their goals.