Security Architect

Remote: Interview by Client KSA
Security Architect
Secure by Design | Information Security
Level Intermediate
Experience 3 to 5 years in information security
Reports to Lead Security Architect, with day-to-day guidance from the Senior
Security Architect
Direct reports None
Location Saudi Arabia (on site) or remote
Role Purpose
The Security Architect applies the organization's Secure by Design (SbD) framework to assigned IT
projects, from initiation to go-live, with guidance and review from the Senior Security Architect.
The role works with project leads, solution architects and project managers, and coordinates with
the Privacy, SOC, Vulnerability Management and Cyber Assurance teams. A key part of the role is
doing assurance checks directly to confirm that security controls are in place before go-live.
Key Responsibilities
1. Secure by Design delivery
• Act as the security point of contact for assigned projects, typically lower and medium-risk
projects, and support the Senior Security Architect on high-risk projects.
• Help project proponents raise SbD requests and complete service profiling.
• Draft security requirements using the controls matrix, requirements catalog and templates.
• Review HLD and LLD documents for security, and raise issues for follow-up. Escalate complex
or disputed design issues to the Senior Security Architect.
• Support threat modelling and prepare threat model documentation.
• Prepare gate endorsement recommendations and evidence for review by the Senior Security
Architect.
2. Assurance checks
• Check that agreed security controls are actually in place before go-live, using one or more of
these methods:
– Screen-share walkthroughs with the system owner or vendor.
– Logging in to the solution directly with read-only or reviewer access.
– Reviewing screenshots and configuration evidence provided by the project team.
• Typical checks include SSO and MFA through Microsoft Entra ID, role-based access, admin
access controls, encryption, logging to Microsoft Sentinel, and backup settings.
• Record the result of each check with evidence, and note any gap or deviation from the endorsed
design.
3. Coordination with Information Security teams
• Privacy team. Collect privacy controls and requirements from the Privacy team and add them
to the project's requirements.
• SOC team. Identify log sources for Microsoft Sentinel and draft abuse cases for the SOC to
build detections.
• Vulnerability Management team. Request SAST, SCA and DAST scans and track remediation of
findings with the project team.
• Penetration testing and Cyber Assurance team. Arrange SaaS assurance checks and on-
premises penetration tests before go-live, and follow up on findings.
• Keep the project lead, solution architect or project manager updated on what each team needs
and what is outstanding.
4. Risk assessment and risk register
• Run risk assessments for assigned projects using the standard templates, with review from the
Senior Security Architect.
• Draft risk register entries with a proposed risk rating, recommended controls and risk owner.
The Senior Security Architect reviews entries before they are finalized.
• Track treatment actions and update the register as risks are closed or accepted.
5. Practice support
• Use the team's templates, patterns and controls matrix, and suggest improvements based on
project experience.
• Support CAB change reviews and vendor security questionnaires when assigned.
Support and Development
The Security Architect will receive regular guidance from the Senior Security Architect, including
review of deliverables, joint sessions on complex projects and coaching on risk assessment and
stakeholder engagement. The role is expected to take on more complex projects with less
supervision over time.
Qualifications
Required
• Bachelor's degree in Computer Science, Information Security, Engineering or a related field.
• 3 to 5 years of information security experience, such as security engineering, security
operations, vulnerability management, GRC or security architecture.
• Working knowledge of NCA ECC, CCC and PDPL.
• Hands-on familiarity with cloud or SaaS platforms and Microsoft Entra ID.
Preferred
• A security certification such as CISSP, CISM, or an associate-level equivalent, or progress
toward one.
• Exposure to Microsoft Sentinel, SAST, DAST or SCA tools.
Technical Knowledge
• Identity and access management: SSO, MFA, role-based access and privileged access.
• Network security basics: segmentation, firewalls and web application firewalls.
• Cloud and SaaS security configuration.
• Logging and monitoring concepts and SIEM use cases.
• Vulnerability scanning and secure development basics.
Skills and Behaviours
• Methodical and evidence-focused when checking controls.
• Communicates clearly with technical teams, vendors and business owners.
• Knows when to escalate and asks for help early.
• Manages several projects at once and keeps trackers up to date.
• Keen to learn and to grow into a senior role.
Success Measures
• Assurance checks are completed before go-live with evidence recorded.
• Risk register entries for assigned projects are complete and pass senior review.
• Coordination items with Privacy, SOC, Vulnerability Management and Cyber Assurance are
tracked to completion.
• Growing independence on project delivery over the first 12 months.

Work arrangement
Yes