AlphaSense is hiring a Senior Enterprise Security Architect

Responsibilities

• Own the architecture: Define and maintain the enterprise security architecture across Zero Trust, identity, network, endpoint, SaaS, infrastructure, mobile, and OT domains.
• Set the standard: Author and govern security architecture principles, reference designs, and technical standards adopted across the organization.
• Lead without authority: Drive alignment across Security Operations, Corporate Technology, Information Engineering, and Integrated IT teams through technical credibility and structured decision-making.
• Anticipate risk: Identify architectural gaps and emerging threat vectors before they become incidents, and prescribe remediation roadmaps.
• Accelerate programs: Provide architecture leadership for strategic security initiatives including Zero Trust maturity, identity consolidation, SaaS governance, and device trust.
• Zero Trust & Network Security Architecture Define and own the Zero Trust and Device Trust architecture strategy, including network segmentation, ZTNA policy design, and enforcement model across corporate and remote environments.
• Architect Cloudflare WARP/Access and equivalent controls for secure remote access, replacing legacy VPN patterns with identity-aware, context-driven enforcement.
• Design network security architecture极 for all office and data center environments including Meraki SD-WAN, firewall policy, 802.1X, and DNS security.
• Establish architecture standards for microsegmentation, East-West traffic inspection, and lateral movement prevention.
• Identity & Access Architecture Own the enterprise identity architecture spanning Okta, SAML/OIDC federation, SCIM provisioning, MFA, Privileged Access Management (PAM), and lifecycle governance across AlphaSense and Tegus tenants.
• Design device trust and certificate-based authentication frameworks integrating MDM (Kandji, Intune), Okta FastPass, TPM/Secure Enclave, and hardware-bound credentials.
• Define role-based access control (RBAC) architecture and Joiner-Mover-Leaver (JML) automation patterns for consistent enforcement across 200+ enterprise applications.
• Architect identity federation patterns for M&A integrations, third-party partners, and customer-facing systems.
• Endpoint & Mobile Security Architecture Define the enterprise endpoint security architecture across macOS, Windows, and mobile platforms, including EDR (CrowdStrike Falcon), MD极 policy standards, and patch management architecture.
• Design mobile device management architecture for corporate and BYOD scenarios, establishing enrollment profiles, compliance policies, and conditional access integration.
• Establish architecture standards for endpoint hardening, application allow-listing, DLP controls, and removable media policy.
• Provide architectural oversight for RMM tooling and极 remote management capabilities, ensuring security boundaries and abuse-resistance controls are embedded by design.
• SaaS & Cloud Security Architecture Define the SaaS security architecture program: vendor risk tiering, security review criteria, integration security standards, and ongoing posture monitoring frameworks.
• Architect CASB, SSPM, and SaaS access governance controls to ensure visibility and enforcement across the business application portfolio.
• Establish data classification and DLP architecture for SaaS environments including Google Workspace, Microsoft 365, Salesforce, and Workday.
• Design AI/shadow SaaS governance architecture, including browser isolation, OAuth scope enforcement, and sanctioned AI tooling controls.
• Internal Infrastructure Security Architecture Define security architecture standards for on-premise and cloud-hosted internal infrastructure including IDF/MDF environments, server rooms, physical access control systems (Brivo), and AV infrastructure.
• Architect logging, SIEM integration, and telemetry collection frameworks ensuring consistent visibility across infrastructure, identity, network, and endpoint layers.
• Design disaster recovery and resilience architecture for critical corporate infrastructure, including offline backup strategies and clean-room recovery playbooks.
• Operational Technology (OT) Security Develop OT security architecture standards for physical and building systems including access control hardware, environmental sensors, and network-connected facility equipment.
• Define segmentation and monitoring architecture to isolate OT environments from corporate IT networks, reducing blast radius and unauthorized access risk.
• Establish a vulnerability management framework for OT assets, accounting for patching constraints and availability requirements unique to operational environments.
• Architecture Governance & Engineering Enablement Maintain a living enterprise security architecture document and domain-level reference architectures, keeping them current with technology changes and threat landscape evolution.
• Conduct security architecture reviews for new technology programs, vendor onboarding, and significant infrastructure changes — providing actionable guidance rather than just approval/denial.
• Define security requirements and acceptance criteria for strategic projects in partnership with Product Security, Engineering, and Corporate Technology.
• Produce architecture decision records (ADRs) and security design patterns that teams can reuse, reducing review cycle time and engineering rework.

Requirements

• 8+ years of experience in information security with at least 4 years in a security architecture, security engineering lead, or equivalent senior technical role.
• Demonstrated expertise designing and implementing Zero Trust architectures in enterprise environments, including ZT极NA, identity-aware access, and microsegmentation.
• Deep knowledge of identity and access management — Okta (or equivalent), SAML, OIDC, SCIM, MFA, PAM, and certificate-based authentication.
• Strong endpoint security architecture experience across macOS and Windows, including EDR (CrowdStrike preferred), MDM (Kandji/Intune), and patch management.
• Experience architecting SaaS security programs including vendor risk frameworks, CASB/SSPM tooling, and OAuth/API integration controls.
• Solid understanding of network security architecture: firewalls, SD-WAN, 802.1X, DNS security, and network segmentation principles.
• Familiarity with OT/IoT security architecture concepts and the challenges of securing non-traditional network-connected assets.
• Proven ability to produce high-quality security architecture documentation including reference architectures, design patterns, and ADRs.
• Strong communicator capable of presenting complex security topics to both technical peers and senior non-technical stakeholders.

Nice to Have

• Professional certifications: CISSP, SABSA, CCSP, or equivalent architecture/security credentials.
• Experience operating in a post-M&A environment with multi-tenant identity and infrastructure consolidation challenges.
• Familiarity with Cloudflare Access/WARP, Meraki, CrowdStrike Falcon, Kandji, Qualys VMDR, or Drata/GRC tooling.
• Experience designing AI governance and shadow SaaS controls for enterprise environments.
• Background working in a regulated industry or supporting compliance frameworks (SOC 2, ISO 27001, FedRAMP).