Information Security Architect

Overview

The Information Security Architect is responsible for designing, assessing, and advancing security architecture across identity and access management, infrastructure, cloud, applications, data, network, endpoint, third-party, and operational technology domains. As a key member of the Security Architecture & Engineering team, this role partners closely with infrastructure, engineering, application development, and security leaders to influence and secure technology decisions across the enterprise.

Key responsibilities include conducting architecture and design reviews, developing and maintaining security standards, embedding secure-by-design principles, evaluating emerging technologies, and designing scalable security controls that align with business objectives, regulatory requirements, and industry best practices. The Information Security Architect maintains a strong understanding of AmTrust’s mission, vision, and values and consistently upholds the standards and culture of the organization.

Responsibilities

• Lead the development of the enterprise cybersecurity architecture vision and technology strategy, aligning business objectives, cyber risk priorities, and security capabilities through actionable roadmaps, target-state architectures, and guiding principles.
• Establish, review, and govern cybersecurity architecture across identity, infrastructure, cloud, applications, data, network, endpoint, third-party, and operational technology domains, ensuring alignment of investments, dependencies, and enterprise priorities.
• Serve as the principal security architecture advisor for complex, high-risk, and cross-functional initiatives; lead architecture governance activities and ensure adherence to security standards, policies, roadmaps, and control requirements.
• Develop, maintain, and promote enterprise security reference architectures, design patterns, control frameworks, and architecture standards to drive consistency, scalability, and secure adoption across the organization.
• Partner with AI governance and technology stakeholders to design cybersecurity processes and controls that enable the secure development, deployment, and operation of AI-enabled solutions.
• Define security architecture guidance for emerging technologies, including Generative AI, with a focus on data protection, access governance, model risk management, responsible AI practices, and secure lifecycle controls.
• Monitor external threat intelligence, emerging attack techniques, regulatory developments, and technology trends to identify strategic risks, opportunities, and future security investment needs.
• Ensure security, platform, and technology vendor selections align with enterprise architecture principles, cybersecurity strategy, risk appetite, and long-term business objectives.
• Champion and embed security-by-design principles, including Zero Trust, least privilege, defense-in-depth, network segmentation, secure configuration, data protection, and cyber resilience across the technology portfolio.
• Collaborate with security operations, risk management, infrastructure, engineering, application development, data, privacy, and compliance teams to ensure solutions effectively support threat detection, incident response, disaster recovery, vulnerability management, and regulatory obligations.
• Establish and maintain cybersecurity architecture quality standards that promote secure engineering practices, operational readiness, observability, resilience, and integrated response capabilities.
• Strengthen organizational security architecture capabilities through mentorship, knowledge sharing, and leadership, fostering a security-first culture across architecture and engineering teams.
• Comply with all company policies, standards, and regulatory requirements, including but not limited to Sarbanes-Oxley (SOX) IT General Controls, Payment Card Industry Data Security Standard (PCI DSS), General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and other applicable legal and regulatory obligations.

Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, Computer Engineering, Information Technology, or a related field, or an equivalent combination of education and relevant work experience.
• 5+ years of progressive experience in Information Security, with demonstrated expertise in designing, implementing, and governing enterprise security capabilities.
• Broad architecture experience spanning cybersecurity, infrastructure, cloud, application, data, identity, and enterprise technology domains, including 5+ years leading enterprise-wide cybersecurity architecture strategy, governance programs, architecture roadmaps, or large-scale security transformation initiatives.
• Proven ability to translate business objectives, regulatory requirements, and cyber risk considerations into scalable security architectures, standards, and strategic technology decisions.
• Strong knowledge of modern security architecture principles and frameworks, including Zero Trust, defense-in-depth, secure-by-design, cloud security, identity and access management, data protection, and cyber resilience.
• Excellent communication, stakeholder management, and leadership skills, with the ability to influence technology and business leaders across all levels of the organization.
• Professional security and architecture certifications preferred, including CISSP, CCSP, CISM, SABSA, TOGAF, AWS Security Specialty, Microsoft Azure Security Engineer Associate, or equivalent industry-recognized credentials.

Preferred:

• Strong knowledge of cybersecurity architecture frameworks, control frameworks, and industry standards, including NIST Cybersecurity Framework (CSF), NIST SP 800-53, ISO 27001, CIS Critical Security Controls, SABSA, Zero Trust Architecture, Secure Software Development Lifecycle (Secure SDLC), threat modeling, and risk-based architectural decision-making.
• Deep understanding of modern security architecture patterns across AWS, Azure, SaaS, IaaS, and PaaS environments, including microservices, APIs, identity and access management (IAM), privileged access management (PAM), encryption, key and secrets management, event-driven architectures, data protection, and security analytics.
• Strong business and risk acumen, with knowledge of operating models, financial management, cost-benefit analysis, cyber risk quantification, and enterprise risk management. Demonstrated ability to define cybersecurity architecture strategy, develop multi-year roadmaps, and govern both current- and target-state architectures at an enterprise scale.
• Proven ability to evaluate cyber threat trends, attack surface exposure, emerging technologies, and evolving regulatory requirements, and to translate those insights into executive-level position papers, strategic recommendations, and investment priorities.
• Demonstrated success leading cross-functional initiatives involving cybersecurity, infrastructure, engineering, application development, cloud, data, risk, privacy, and compliance teams, while mentoring and developing architects and engineers through coaching, collaboration, and delegation.
• Recognized leader in cybersecurity architecture with a demonstrated track record of influencing enterprise security strategy, reducing systemic cyber risk, enabling secure business transformation, and providing trusted guidance on cybersecurity investments and technology decisions.

This job description is designed to provide a general overview of the requirements of the job and does not entail a comprehensive listing of all activities, duties, or responsibilities that will be required in this position.

#LI-BL1

What We Offer

AmTrust Financial Services offers a competitive compensation package and excellent career advancement opportunities. Our benefits include Medical & Dental Plans, Life Insurance, including eligible spouses & children, Health Care Flexible Spending, Dependent Care, 401k Savings Plans, Paid Time Off.

AmTrust strives to create a diverse and inclusive culture where thoughts and ideas of all employees are appreciated and respected. This concept encompasses but is not limited to human differences with regard to race, ethnicity, gender, sexual orientation, culture, religion or disabilities.

AmTrust values excellence and recognizes that by embracing the diverse backgrounds, skills, and perspectives of its workforce, it will sustain a competitive advantage and remain an employer of choice. Diversity is a business imperative, enabling us to attract, retain and develop the best talent available. We see diversity as more than just policies and practices. It is an integral part of who we are as a company, how we operate and how we see our future.