Senior Security Architect

Role Purpose: The Senior Security Architect is the security subject matter expert on assigned IT projects, from initiation to go-live. The role applies the organization's Secure by Design (SbD) framework so that security is built into solutions. The role is the single security point of contact for the project lead, solution architect and project manager. It gathers inputs from the other Information Security teams (Privacy, SOC, Vulnerability Management and Cyber Assurance), passes them to the project, and makes sure their outputs are delivered before go-live. The role also maintains the security architecture practice and mentors the Security Architect. Key Responsibilities: 1. Secure by Design delivery • Act as the security SME for each assigned project through every SbD phase: initiation, service profiling, design, build, assurance and go-live approval. • Engage with project proponents early. Explain the SbD process, help them raise the SbD request and complete service profiling to set the project's risk level. • Define security requirements for each project from the controls matrix, the requirements catalog, applicable policies and regulations. • Review high-level and low-level designs (HLD and LLD) for security and alignment with the architecture principles. Raise design issues and follow them up until they are fixed. • Run threat modelling on new or significantly changed solutions. • Carry out security architecture assurance: confirm that what was built matches the endorsed design and that all required controls are in place. • Give security endorsement at project gates (for example, before procurement, before infrastructure build and before go-live), and keep evidence of each decision. 2. Coordination with Information Security teams • Broker inputs and outputs. Collect inputs from each team, pass them to the project lead, solution architect or project manager, and track that the outputs are delivered on time. • Privacy team. Obtain privacy controls and requirements for the solution, including data protection and data sharing requirements, and include them in the project's security requirements. • SOC team. Identify the log sources the solution must send to Microsoft Sentinel, and define the abuse cases and use cases the SOC needs to build detections and alerts. • Vulnerability Management team. Make sure solutions are free of open vulnerabilities before go-live, including code scanning (SAST), software composition analysis (SCA) and dynamic testing (DAST) findings. Track remediation of anything raised. • Penetration testing and Cyber Assurance team. Arrange assurance checks for SaaS solutions and penetration testing for on-premises solutions before go-live. Make sure findings are fixed or risk-assessed. 3. Risk assessment and risk register • Run cyber risk assessments for each project, combining findings from design reviews, threat models, scans, assurance checks and penetration tests. • Record every finding in the risk register with a risk rating, recommended controls, risk owner and treatment plan. • Present risks to project stakeholders and decision-makers, and obtain formal risk acceptance at the right authority level where a risk is not treated. • Track treatment actions until the risk is closed or formally accepted. 4. Security architecture practice • Maintain and improve practice assets: security architecture templates, risk assessment templates, the security controls matrix, the reusable security requirements catalog and the SbD profiling guide. • Develop and maintain reusable security architecture patterns, such as SaaS and single sign-on (SSO) integration with Microsoft Entra ID. • Map controls to regulatory requirements (NCA ECC, CCC and PDPL) and to the organization's security roadmap. • Identify gaps and inconsistencies in the SbD framework and propose improvements. 5. Change, procurement and contract reviews • Review changes submitted to the Change Advisory Board (CAB) for security impact and alignment with architecture standards. • Write security requirements for RFPs, prepare vendor security questions, and evaluate the security sections of vendor proposals. • Review contracts and data processing agreements for security clauses. 6. Mentoring and quality • Mentor the Security Architect on SbD delivery, risk assessment and stakeholder engagement. • Review the Security Architect's deliverables (requirements, design reviews, assurance evidence and risk entries) before they are issued. • Act as the escalation point for complex, high-risk or disputed projects. Required Qualifications: • Bachelor's degree in Computer Science, Information Security, Engineering or a related field. • 10 to 15 years of information security experience, including at least 5 years in security architecture or Secure by Design roles. • CISSP or CISM certification. • Working knowledge of Saudi regulations: NCA Essential Cybersecurity Controls (ECC), Cloud Cybersecurity Controls (CCC) and the Personal Data Protection Law (PDPL). • Proven experience running risk assessments and threat modelling and managing findings in a risk register. Preferred: • SABSA or TOGAF certification. • Experience building or running a Secure by Design function or security architecture practice. Technical Knowledge • Cloud and SaaS security architecture (Microsoft Azure and SaaS platforms), including landing zone design. • Identity and access management with Microsoft Entra ID: SSO, MFA, conditional access, role based access, privileged identity management and access reviews. • Network security: segmentation, firewalls, web application firewalls and secure remote access. • Security monitoring with Microsoft Sentinel: log source onboarding and detection use cases. • Secure software development: SAST, DAST and SCA tooling and how to interpret results. • Endpoint protection (EDR), encryption, backup and recovery controls. • Frameworks such as NIST CSF and ISO/IEC 27001. Skills and Behavior: • Explains security in plain business terms and positions security as a design partner, not only an approval gate. • Manages many projects in parallel and prioritizes by risk. • Influences project teams, vendors and senior stakeholders without direct authority. • Writes clear, audit-ready documentation and keeps evidence of decisions. • Coaches others and raises the quality of the team's work.