Citi Group Cyber Architect - SVP 

United States, Texas, Houston 

607142112

The Cyber Architect is a senior-level CISO professional, and this position supports the Global Functions and Technology business. The Cyber architect works as a trusted security advisor to the Application Development and Engineering teams to ensure solutions are developed in line with security requirements, architecture principals as well as policy/standards, and facilitate security-related discussions. The Cyber architect will engage with stakeholders throughout the system development lifecycle to ensure proper technology information security risk considerations are addressed at each phase of the system development life cycle and provide proactive solutions to remediate or mitigate risk. The individual should demonstrate an understanding of application security and will exercise judgment within existing practices and policies.

You will join an experienced team of IS specialists that have been tasked with performing Is assessments including threat modeling and proposing technical controls for our business-critical applications. You will work on some of the most cutting-edge technologies and provide value by solving real world problems. Your key stakeholders will be application development teams, product, the CISO, Risk and Control partners.

Responsibilities:

• Provides architectural vision for all IT systems, including those that support Internet applications, ensuring that architecture conforms to enterprise blueprints.
• Develops security architecture, strategy, planning, and problem solving IT solutions including emerging technologies for processing data on prem, and cloud.
• Perform security architecture and risk assessment of internally developed, and vendor IT systems and applications leveraging best practices including threat modelling. Ensure that security design and controls are consistent with organization's security architecture principals.
• Develop strategies and security controls for above, and partner with IT architecture/development stakeholders to implement during early in system development life cycle.
• Ensure that security architectures are resilient, reliable, and scalable.
• Provide security recommendations including automated controls, security configurations and advise on strategies as well as compensating controls to manage risk to acceptable tolerance levels.
• Perform root cause analysis, identify thematic security architecture improvements, and create security patterns as well as frameworks that can accelerate faster secure delivery of products to market.
• Ensure compliance of IT systems with Citi information security policies, standards, and processes.
• Shape Global Information Security policies, standards, and program leveraging subject matter knowledge, as well as industry partnerships.
• Establish relationships with cross-functional areas including Business, Technology, and Compliance stakeholders and serve as a security subject-matter expert.
• Promote awareness and provide consistent interpretation of security policy to technology and business teams.
• Interfaces across several channels, acting as a visionary to proactively assist in defining direction for future projects.
• Maintains continuous awareness of business, technical, and infrastructure issues and acts as a sounding board or consultant to aid in the development of creative solutions.
• Interfaces with vendors to assess their technology and to guide their product roadmap based on Citi requirements.
• Exhibits in-depth knowledge of how own specialism contributes to the business and has a good understanding of the commercial environment.
• Impacts the technology function through contribution to technical direction and strategic decisions.
• Uses developed communication skills to negotiate and often at higher levels.
• Performs other job duties and functions as assigned
• Appropriately assess risk when business decisions are made, demonstrating particular consideration for the firm's reputation and safeguarding Citigroup, its clients and assets, by driving compliance with applicable laws, rules and regulations, adhering to Policy, applying sound ethical judgment regarding personal behavior, conduct and business practices, and escalating, managing and reporting control issues with transparency.

Qualifications:

• Sound understanding of Information security domains such as Identity access management, Cryptography, Data protection, Vulnerability Assessment, Audit Logging/Monitoring, etc.
• 10+ years as Security Architect assessing IT infrastructure, applications and vendor SaaS solutions is required.
• Proficiency with security frameworks and standards (e.g. TOGAF, SABSA, MITRE ATT&ACK, NIST 800-53, ISO 27001),
• Threat modelling using industry standard methodologies (e.g. STRIDE/DREAD/MITRE) is must
• Experience developing Reference Security Architecture and Design Patterns to support proactive and automated controls.
• Sound understanding and security architecture/engineering experience with one or more IT systems such as
  • Cloud (e.g. AWS/GCP/Azure/Oracle)
  • Containerization and Virtualization technologies such as Kubernetes ( OpenShift, AWS EKS, Google GKS), Service Mesh ( Istio ), Kubevirt and VMWare
  • Firewall, Network Security, Software Defined Networks, CASB, SASE and Micro segmentation.
  • Middleware and Webserver technologies such as IBM Websphere, Tomcat, Apache Webserver, IIS and NGINX
  • API Gateway technologies such as Apigee Edge, Kong and AWS API Gateway.
  • Enterprise scale Web and Mobile applications
  • Authentication security patterns involving OpenID connect, Oauth, SAML, Kerberos specifications in hybrid environment.
  • Infrastructure as Code (IaC) for automation. Experience with IaC products/tools such Terraform, Chef and Ansible.
• Good knowledge of software development processes (SLDC/Agile/Iterative/DevOps)
• Software development experience is a plus
• Strong inter personnel skills and ability to influence outcomes in the collaborative environment.
• Strong communication skills interacting with senior technology and business management.
• Consistently demonstrates clear and concise written and verbal communication
• Management and prioritization skills
• Ability to manage multiple activities and changing priorities
• Ability to work under pressure and to meet tight deadlines
• Self-starter with ability to take the initiative and master new tasks quickly
• Methodical, attention to detail

Education:

• Bachelor’s/University degree or equivalent experience, potentially Masters degree

Certifications:

• Industry standard security certifications is plus (e.g. ISACA, ISC2, CSPs)

This job description provides a high-level review of the types of work performed. Other job-related duties may be assigned as required.

Anticipated Posting Close Date:

View the " " poster. View the .

View the .

View the