Enterprise Architect - Zero Trust

Security Architect - Zero Trust Architecture

• Security Architect - Zero Trust Architecture
• Charlotte, NC
• Hybrid role (3 days onsite, 2 days remote)
• Pay: $65-$75 per hour
• 12-month contract with strong potential for extension or full-time conversion

Objective:

Lead the design, governance, and adoption of enterprise Zero Trust Architecture (ZTA) aligned to NIST SP 800-207 and organizational security strategy. Define and operationalize a "never trust, always verify" model across identity, devices, networks, applications, and data. Drive the transition from perimeter-based security to policy-driven, risk-aware access controls that enforce least privilege and continuous verification across all enterprise resources.

Key Responsibilities:

Architecture & Strategy

• Define and maintain the enterprise Zero Trust Architecture (ZTA) reference model, aligned to industry frameworks (NIST SP 800-207, CISA ZTMM) and business priorities.
• Establish target-state architectures and transition roadmaps for Zero Trust adoption across hybrid cloud, SaaS, and on-prem environments.
• Define policy-driven access models leveraging identity, device posture, behavior, and environmental risk signals.
• Align Zero Trust architecture with enterprise security strategy, cloud adoption, and digital transformation initiatives.

Architecture & Governance

• Lead end-to-end architecture reviews ensuring solutions align with Zero Trust principles, including least privilege, continuous verification, and explicit trust evaluation.
• Define and enforce architectural guardrails and secure patterns across identity, network, endpoint, application, and data layers.
• Establish policy decision and enforcement models (PDP/PEP) across enterprise control points (identity providers, gateways, endpoints, network controls).
• Provide governance and oversight for Zero Trust capabilities across business units, platforms, and shared services.

Cross-Domain Integration

• Design integration patterns that unify IAM, endpoint security, network controls, application access, and data protection into a cohesive Zero Trust model.
• Define how identity, device posture, and risk signals drive dynamic access decisions across APIs, applications, and infrastructure.
• Collaborate with domain architects (IAM, Network, Cloud, Endpoint, Data) to ensure consistent enforcement of Zero Trust controls and patterns.
• Enable secure service-to-service and user-to-resource access patterns across distributed architectures (microservices, APIs, SaaS).

Policy, Access & Control Enforcement

• Define enterprise access control strategies including adaptive authentication, conditional access, and fine-grained authorization.
• Establish policy models for user, service, and machine identity access, incorporating RBAC, ABAC, and policy-based access control.
• Define enforcement patterns across gateways, proxies, API layers, and endpoint controls to ensure consistent access decisions.
• Integrate continuous monitoring and feedback loops to adjust access decisions based on real-time risk and context.

Threat Modeling, Risk & Assurance

• Lead threat modeling initiatives focused on lateral movement, identity compromise, session hijacking, and trust boundary violations.
• Define security controls to mitigate Zero Trust-specific attack vectors (credential abuse, privilege escalation, bypass of enforcement points).
• Ensure Zero Trust architecture aligns with regulatory requirements and supports continuous risk reduction and measurable security outcomes.
• Establish metrics and maturity indicators for Zero Trust adoption and effectiveness across the enterprise.

Engineering Enablement & Adoption

• Drive adoption of Zero Trust patterns through reusable architectures, reference implementations, and engineering guidance.
• Partner with engineering, platform, and security teams to embed Zero Trust controls into SDLC, CI/CD, and platform engineering workflows.
• Evaluate and recommend technologies supporting Zero Trust capabilities (identity platforms, ZTNA, microsegmentation, API gateways, endpoint posture).
• Communicate architecture strategy, tradeoffs, and risk posture clearly to engineering, product, and executive stakeholders.

Core Security Domains

Identity & Access Management

Authentication, federation, adaptive MFA, conditional access, service-to-service identity, least privilege, and identity governance.

Device & Endpoint Security

Device posture, endpoint detection and response (EDR), mobile/device trust, health validation, and enforcement of device-based access conditions.

Network Security & Segmentation

Microsegmentation, software-defined perimeters, ingress/egress controls, secure connectivity, and enforcement of network-level policy decisions.

Application & API Security

Application access control, API authentication/authorization, secure service communication, token-based access, and policy enforcement at application layers.

Data Security

Data classification, encryption, data minimization, access controls aligned to sensitivity, and protection of data across states (in transit, at rest, in use).

Visibility, Analytics & Automation

Centralized telemetry, continuous monitoring, behavioral analytics, policy decision support, and automated response and enforcement.

GenAI Security

• Define secure GenAI patterns (LLM access controls, prompt/response handling, RAG security, agent/tooling boundaries).
• Threat model GenAI use cases (prompt injection, data leakage, model extraction/poisoning, unsafe output handling) and define mitigations/testing.
• Set GenAI data governance requirements (sensitive data use, retention, auditability) and vendor/model assurance expectations.

MINIMUM QUALIFICATIONS:

• 7+ years of relevant experience
• Bachelor's Degree in Computer Science, Information Security, or related field of study or equivalent

PREFERRED QUALIFICATIONS:

• Master's in Computer Science, Information Security, or related field.
• 5+ years designing or implementing Zero Trust Architecture or similar enterprise security transformation initiatives
• Deep understanding of Zero Trust principles and frameworks (NIST SP 800-207, CISA Zero Trust Maturity Model)
• Strong experience in IAM, authentication/authorization, and policy-based access control models
• Experience with network security, segmentation, ZTNA, and modern connectivity architectures
• Experience with endpoint/device security and integration of device posture into access decisions
• Experience designing secure architectures across hybrid cloud (AWS/Azure), SaaS, and on-prem environments
• Proven experience integrating multiple security domains into cohesive architecture patterns
• Hands-on or architectural experience with technologies such as identity platforms, ZTNA solutions, API gateways, and microsegmentation tools
• Strong experience with threat modeling, architecture reviews, and security risk assessments
• Familiarity with regulatory frameworks (FFIEC, PCI DSS, SOX) and security frameworks (NIST, CIS)
• Demonstrated ability to influence cross-functional teams and drive enterprise adoption of security patterns
• Strong communication and executive presentation skills

#LI-WM1