Cyber Security – Senior Enterprise Security Architect

London

See advert for pay

Position: Cyber Security – Senior Enterprise Security Architect
Location: London, UK (Hybrid-4 days from office)
6 months contract position

Role overview:

We are seeking a seasoned, strategic, and hands-on Senior Enterprise Security Architect to lead the foundational implementation of the Centre for Internet Security (CIS) Critical Security Controls (CSC) across our entire enterprise. You will be the primary architect responsible for transitioning our security posture from current state to a robust, CIS-aligned framework, ensuring that security is deeply integrated into our infrastructure, cloud environments, and business operations.

Your responsibilities:

Strategic Framework Alignment: Lead the end-to-end design and roadmap for implementing CIS Controls (v8 or latest) from the ground up, mapping current technical controls to the CIS framework.
Infrastructure & Cloud Security Architecture: Define and enforce secure architecture patterns for on-premises, hybrid, and multi-cloud (AWS/Azure/GCP) environments, ensuring compliance with CIS Benchmarks.
Policy & Governance: Develop and document enterprise-wide security policies, standards, and procedures derived from CIS implementation groups (IG1, IG2, IG3) to ensure scalable security.
Technical Implementation Oversight: Collaborate closely with DevOps, Network Engineering, and IT Operations teams to automate security configurations (e.g., automated patching, hardening, configuration management).
Asset Management & Visibility: Design robust solutions for automated hardware and software asset inventory—a critical prerequisite for effective CIS implementation.
Vulnerability & Risk Management: Establish and mature enterprise vulnerability management processes to ensure continuous identification and remediation of risks as prioritized by the CIS framework.
Stakeholder Engagement: Act as the primary subject matter expert, effectively communicating security requirements, project milestones, and risk posture to executive leadership and technical staff alike.

Your Profile

Experience: 10+ years in Cybersecurity, with at least 5 years in a senior architecture or lead security role.

Framework Expertise: Deep, hands-on experience implementing CIS Critical Security Controls in large-scale enterprise environments.

Cloud Fluency: Demonstrated architectural design experience in secure cloud migrations and cloud-native security practices.

Automation: Strong belief in and experience with "Security as Code" principles; proficiency in scripting (Python, PowerShell) or Infrastructure as Code (Terraform, Ansible) to automate hardening.

Hardening Standards: Expert-level knowledge of CIS Benchmarks for operating systems (Linux/Windows), cloud platforms, and network devices.

Communication: Proven ability to bridge the gap between technical teams and business stakeholders, articulating security risks in plain language.

Senior Stakeholder Management – Proficient and experience in communication at executive levels within the organisation, reports, PowerPoint and presentation

Preferred Technical Proficiency Requirements

Cloud & Infrastructure:
Cloud Security: Expert knowledge of AWS (Control Tower, SCPs), Azure (Blueprints, Policy), and GCP (Organization Policy Service).
Infrastructure as Code (IaC): Advanced proficiency in Terraform, Ansible, or Bicep to enforce security configurations at scale (GitOps approach).
Identity & Access Management (IAM): Deep understanding of Zero Trust Architecture (ZTA), RBAC/ABAC models, and integration with Enterprise IAM (Okta, Entra ID, Ping).
Operating System Hardening: Hands-on experience applying CIS Benchmarks to Linux (RHEL, Ubuntu, Alpine) and Windows Server environments using automated configuration management.
Security Operations & Tooling:
Vulnerability Management: Experience with enterprise tools like Tenable.io, Qualys, or Rapid7 to map findings directly to CIS Control 7.
EDR/XDR Integration: Expert-level deployment of tools (e.g., CrowdStrike, SentinelOne) to achieve full visibility across endpoints (CIS Control 6).
SIEM/SOAR: Experience designing log aggregation and automated response playbooks in platforms like Splunk, Microsoft Sentinel, or Google Chronicle to satisfy monitoring requirements (CIS Control 8).
Asset Management: Implementation of automated discovery tools (e.g., CMDB Lansweeper) to maintain a dynamic inventory of hardware and software (CIS Controls 1 & 2).
Network & Endpoint Security:
Micro-segmentation: Expertise in network design (NSX, Illumio, or Cloud-native security groups) to enforce granular traffic control (CIS Control 12).
Encryption: Implementation of Data-at-Rest and Data-in-Transit standards (TLS 1.3, AES-256, HSMs, and Key Management Systems).