IT Security Architect

• Minimum 5 years in the IT sector and at least 3 in roles related to security and architecture.
• Experience in the definition and implementation of secure DevSecOps models.
• Experience in defining standards and security architecture patterns.
• Participation in audit and regulatory compliance processes in regulated environments, preferably financial, insurance, telco, or public sector.
• Experience collaborating with multidisciplinary teams and technological providers.

Demonstrable experience in:

• Secure development in SDLC (S-SDLC): knowledge and experience in the implementation of DevSecOps practices in the SDLC, integrating security controls in all phases of software development, including DevOps processes, CI/CD platforms, and application testing.
• Application and API security: experience in designing secure architectures for applications, digital services, and API ecosystems, applying Security by Design principles, secure coding, and interface protection.
• Vulnerability and threat management: experience in the design and application of early identification mechanisms, continuous vulnerability management, and technological risk assessment.
• Identity and access management (IAM / PAM): experience in identity federation, SSO, and MFA, knowledge of protocols (SAML, OAuth2, OpenID Connect, LDAP), use of identity platforms (Azure AD, Okta, Ping Identity, Red Hat IdM), and privileged access management (PAM).
• Security regulations: knowledge of frameworks such as ISO 27001, NIST CSF, GDPR, DORA, EBA, and ENS.
• Data and information protection and cryptography: knowledge in data classification and labeling, encryption in transit and at rest (TLS, AES, KMS, HSM), DLP solutions, as well as secrets and key management (HashiCorp Vault, Azure Key Vault, AWS KMS) and cryptography.
• Infrastructure, systems, and virtualization: experience in hardening Linux and Windows systems, secure virtualization (VMware, Hyper-V, KVM), security in containers and orchestrators (Docker, Kubernetes, OpenShift), and design of multi-platform architectures (cloud + on-prem).
• Availability and continuity: of resilient and fault-tolerant architectures, high availability (HA) strategies, and disaster recovery.
• Logging, monitoring, and response: participation in centralized logging and continuous monitoring design, use of SIEM/SOAR (e.g., Splunk, Sentinel, QRadar), incident management and coordination with SOC/CSIRT, and security alert configuration.

• Security certifications (CISSP, CISM, CCSP).
• Certification in DevSecOps.
• Certification in integration platforms or architectures.
• Advanced cloud certifications in Azure, AWS, or Google Cloud (e.g., Solutions Architect, Security Specialty).
• Experience in technological transformation initiatives in large companies will be valued.
• Experience with enterprise architecture modeling tools, especially ARIS.
• Enterprise architecture capabilities, enhancing the value of IT to the business.
• Functional knowledge and experience in the healthcare sector.
• Insurance reference models, such as ACORD.
• Architecture frameworks, such as TOGAF.
• Experience in project management.
• Knowledge of agile methodologies.
• Knowledge of corporate management tools, especially SAP products.
• Knowledge of cloud technology stacks, in SaaS, PaaS models, etc. (AWS, Azure, Google Cloud)
• Experience in IT management and governance models.
• Experience in managing relationships with suppliers.

• Bachelor's degree in Computer Science, Telecommunications, or equivalent.
• English proficiency required at a minimum B2 level (C1 desirable).

As a Security Architect, your objective will be to collaborate in the design, implementation, and evolution of corporate security architectures, standards, and patterns, promoting the adoption of Security by Design and Zero Trust principles and ensuring their application in the organization's technological projects, platforms, and services, under the coordination of the Security Architecture Lead.

The main mission of the position will be to ensure the integration of security principles and controls throughout the entire lifecycle of technological solutions, from design to production operation. To this end, you will collaborate with the architecture, development, infrastructure, operations, and global security areas, providing technical criteria, designs, recommendations, and specialized documentation, as well as support in governance, transformation, regulatory compliance, and audit processes.

• You will execute the activities assigned within the domain, reporting to the Security Architecture Coordinator.
• You will collaborate in the technical planning of activities with external providers and communicate needs, dependencies, risks, and deviations to the Security Architecture Coordinator.
• You will develop your activities according to the priorities, criteria, and work plans established by the Security Architecture Coordinator.
• You will act as a technical interlocutor in assigned matters with Information Security, Infrastructure and Operations, QA, and Development.
• You will collaborate with the Technological Architecture and Enterprise Architecture subdomains to apply the defined security criteria and decisions.
• You will participate in technical or operational sessions and forums, ensuring the application of the Corporate Security Reference Architecture.

Technological evolution of the security reference architecture

• You will contribute to the definition and execution of the Security Architecture evolution roadmap.
• You will update standards and design patterns and define best practices for application to the software development lifecycle.
• You will analyze security trends and solutions, performing proofs of concept for solutions that may be adopted in the corporate context.
• You will collaborate in the editing and reviewing of technical application designs together with project teams, issuing assessments that ensure projects comply with the guidelines defined in the Security Reference Architecture.
• You will verify that developments, testing, and deployments are carried out within the established security controls.
• You will participate in project phases that require domain intervention, including definition, design, construction, deployment, and operation.
• You will analyze and incorporate security requirements from the demand stage and throughout the entire lifecycle of applications and services.
• You will analyze security incidents, propose mitigation measures, and perform technical follow-up on assigned exceptions and actions.
• You will provide technical support in internal and external audits, preparing evidence and collaborating in the resolution of assigned findings.
• You will provide transversal technical support to teams regarding security architecture.
• You will collect and maintain the information necessary to measure the activity and effectiveness of the implemented security controls, reporting it to the Coordinator.

• Technical interlocution and communication capacity, collaborating with multidisciplinary teams by adapting the message based on the knowledge and level of the interlocutor.
• Rigor in the application of governance processes and traceability.
• Result orientation, balancing security requirements with project deadlines and constraints.
• Innovative attitude and constant updating on security and architecture trends.
• Collaboration with teams and providers: ability to work with multidisciplinary teams and external providers, performing technical follow-up of activities and deliverables.
• Planning and prioritization: ability to organize assigned work, identify dependencies and risks, and apply the priorities established by the domain.
• Analytical capacity: ability to collect indicators, monitor security metrics, and synthesize technical results for reporting.
• Project management: experience in technological initiatives developed with traditional or agile methodologies, managing assigned tasks and deliverables.