LEAD ZERO TRUST ARCHITECT

Job Description

Job Description

About the Role

Triple Point Security is looking for a Lead Zero Trust Architect to join our team supporting a national research organization's enterprise Zero Trust program. Over the past few years, our team has helped this client assess its Zero Trust maturity and build roadmaps toward Advanced and Optimal maturity levels. The next phase focuses on helping the organization's institutes and system owners understand, adopt, and receive credit for the Zero Trust capabilities already provided at the enterprise level.

In this role, you will lead a small architecture and engineering team, including a Cloud/Hybrid Architect and two ZTA Controls Analysts, responsible for the future state Zero Trust architecture, reference architectures for cloud, on-premises, and hybrid environments, and control inheritance documentation. You will also work directly on tracking how Zero Trust requirements are built into the client's authorization, funding, and investment processes, and on aligning the target architecture with the client's enterprise architecture.

This is a client-facing position. You will work regularly with client leadership, architecture and security offices, and system owners, and you can expect to present architecture recommendations, facilitate working sessions and review meetings, and help lead the monthly office hours we host for the client's institutes. Your work will have a meaningful impact on the medical and scientific communities our client serves.

Required Qualifications

• Bachelor's degree in Computer Science, Information Systems, Cybersecurity, Engineering, or a related field from an accredited university
• 5+ years of experience in cybersecurity architecture, enterprise security architecture, or security engineering, including demonstrated experience designing, assessing, or implementing Zero Trust Architecture in a Federal or large enterprise environment
• Working knowledge of NIST SP 800-207, the CISA Zero Trust Maturity Model (ZTMM) v2.0 (five pillars and three cross-cutting capabilities), OMB Memorandum M-22-09, and Executive Order 14028
• Strong knowledge of NIST SP 800-53 Rev. 5 and the NIST Risk Management Framework (SP 800-37), including common, hybrid, and system-specific controls and how control inheritance is claimed and evidenced
• Experience developing target-state architectures, reference architectures, or reusable design patterns spanning cloud, on-premises, and hybrid environments
• Hands-on architecture experience in at least one major cloud service provider (AWS, Azure, or GCP), including identity and access management, network segmentation, and logging and monitoring
• Experience mapping security controls to capability frameworks or maturity models and producing traceability matrices, gap analyses, and remediation roadmaps
• Experience leading technical staff, including assigning and sequencing work, reviewing deliverables for technical accuracy, and holding a team to fixed deliverable dates
• Strong written communication skills, including the ability to produce clear, well-organized architecture deliverables for both technical and non-technical readers
• Experience in client-facing roles, including presenting recommendations to senior leadership and governance bodies, facilitating meetings and working sessions, and building agreement among stakeholders with different priorities
• Proven problem solving, critical analysis, and risk-based thinking skills to prioritize architecture recommendations against available time, budget, and staffing

Preferred Qualifications

• 8+ years of experience in cybersecurity or IT architecture, including 3+ years in a lead or senior architect role
• Master's degree in Cybersecurity, Information Systems, Computer Science, or a related field
• Experience supporting Federal civilian agencies, particularly HHS or other research and health organizations with federated IT operating models
• Experience with enterprise architecture frameworks (TOGAF, FEAF) and with mapping a target architecture to Business, Data, Application, Technology/Infrastructure, and Security Architecture domains
• Experience embedding security requirements into IT governance and funding processes such as Capital Planning and Investment Control (CPIC), Enterprise Performance Life Cycle (EPLC) stage gates, ATO/A&A reviews, O&M project justifications, acquisition reviews, or architecture review boards
• Experience recording control inheritance in GRC tools such as CSAM/JCAM, RSA Archer, or ServiceNow IRM
• Familiarity with FedRAMP, Trusted Internet Connections (TIC) 3.0, CISA Continuous Diagnostics and Mitigation (CDM), and NIST SP 1800-35 (Implementing a Zero Trust Architecture)
• Experience with infrastructure-as-code (Terraform, CloudFormation, Bicep) and policy-as-code, including using automation to produce continuous monitoring evidence
• Hands-on experience with ZT enabling technologies such as ICAM and PIV/PKI, Entra ID or Okta, ZTNA/SASE, micro-segmentation, and EDR/device posture solutions
• Experience developing and delivering training, briefings, or recurring stakeholder forums such as office hours or communities of practice
• Prior experience in a consulting or professional services environment, including contributing to technical proposals and capability briefings

Certifications

• Required:  at least one active senior cybersecurity certification: CISSP (Certified Information Systems Security Professional), CISSP-ISSAP (Information Systems Security Architecture Professional), CCSP (Certified Cloud Security Professional), or equivalent
• Preferred:  Cloud Security Alliance Certificate of Competence in Zero Trust (CCZT)
• Preferred:  AWS Certified Security – Specialty, Microsoft Certified: Cybersecurity Architect Expert, Microsoft Certified: Azure Security Engineer Associate, Google Professional Cloud Security Engineer, or equivalent cloud security certification
• Preferred:  TOGAF Enterprise Architecture certification
• Preferred:  CGRC (Certified in Governance, Risk and Compliance, formerly CAP) or CISM

Clearance and Suitability

• Must be a U.S. citizen (client requirement).
• Must be able to obtain and maintain a client suitability determination (Public Trust) and a client-issued Personal Identity Verification (PIV) credential, and complete required security and privacy training prior to access.

Responsibilities

• Lead the Architecture & Engineering workstream: set the technical approach, assign and sequence work across the Cloud/Hybrid Architect and ZTA Controls Analysts, and review every team deliverable for technical accuracy before it enters independent quality review

• Develop the Future State ZTA, integrating identity, device, network, application/workload, and data security controls supported by automation, orchestration, and continuous monitoring, aligned with Executive Order 14028, OMB M-22-09, the HHS ZTA, and CISA ZTMM v2.0, targeting Advanced maturity enterprise-wide and Optimal maturity for selected critical systems
• Own the ZTA process integration tracker: identify, document, and maintain the processes and funding mechanisms that should require ZT evidence, including ATO/A&A reviews, cybersecurity funding requests, O&M project justifications, CPIC submissions, and procurement/acquisition reviews; for each, record the process owner, decision point, required evidence, insertion mechanism, approving governance body, and cycle date
• Sequence ZT requirement insertions against the funding and planning calendars that govern them, and publish provisional criteria for the following cycle wherever the current cycle has closed
• Map the Future State Target Architecture to the organization's Business, Data, Application, Technology/Infrastructure, and Security Architecture domains using the client's own taxonomy and existing architecture artifacts, in close coordination with the client's IT architecture office
• Direct development of gold-standard reference architectures for cloud, on-premises, and hybrid environments as a cloud-agnostic pattern core with per-platform implementation guidance for AWS, Azure, and GCP, specifying for each pattern which controls are enforced through infrastructure-as-code, which are orchestrated across services, and which produce continuous monitoring evidence automatically
• Oversee the centrally provided services matrix, ensuring each capability identifies the NIST SP 800-53 Rev. 5 controls it addresses, marks each as fully, partially, or not inherited, and carries customer responsibility statements, citable evidence sources, and suggested system security plan language
• Oversee the mapping of the organization's FISMA-reportable systems against centrally provided and inherited ZT controls, including the bi-directional NIST SP 800-53 to ZTMM mapping, identification of unclaimed inheritance, and a risk-informed remediation roadmap
• Coordinate architecture positions with enterprise service owners, including cloud services, network services, identity and access management, and security operations, and with the client's governance, risk, and compliance and security assurance offices
• Provide architecture input to the ZTA control overlay, policy anchors, and architecture review criteria and checkpoints so that all ZT expectations derive from one consistent source
• Lead the architecture portion of the coordinated quarterly refresh cycle, checking any change in a centrally provided capability against every artifact that references it before the cycle closes
• Present architecture recommendations, deliverables, and status updates to client leadership, governance bodies, and technical stakeholders
• Plan and facilitate client working sessions, architecture reviews, and stakeholder meetings, including preparing agendas and materials and tracking decisions and action items
• Serve as the architecture subject matter expert for monthly institute office hours, ZTA knowledge base content, and enterprise help desk inquiries
• Mentor analysts, junior engineers, and interns on ZT architecture, control inheritance, and Federal compliance requirements
• Support business development efforts including proposal contributions, technical solutioning, and client presentations

• Stay current with evolving Federal ZT policy, CISA guidance, the threat landscape, and emerging ZT technologies

About Triple Point Security

Triple Point Security is a technical cybersecurity and cloud security firm that provides highly specialized services to organizations with complex, hybrid IT environments. We have experienced tremendous growth through our Zero-Trust Architecture (ZTA), DevSecOps, and secure AI adoption services and are looking to continue this momentum with our cloud service provider, technology, and teaming partners.

Our professionals possess public sector experience in the Department of Health and Human Services (HHS), Department of Defense (DOD), and Department of Justice (DOJ). They also possess private sector experience in telecommunications, finance, managed service providers, and Internet infrastructure. We combine our technical knowledge with best practices from the public and private sectors and apply them to IT security solutions and services that support our clients in achieving their business and mission objectives.

Benefit Highlights

• 401(k) company matching contributions
• 100% of premium cost for basic employee coverage: Health, Dental, and Vision
• 100% of premium cost: Basic Life AD&D, Short Term Disability, and Long Term Disability
• Flexible Spending Accounts: Health, Dependent Care, and Mass Transit & Parking
• Tuition & Training Reimbursement
• Paid Time Off plus 10 Paid Holidays
• Performance and referral Bonus
• Flexible work schedule (with client approval)
• Employee Assistance Program
• Call A Doctor Plus Telemedicine Service
• MetLaw Group Legal Services
• Technology resources (HW/SW), online training, and virtual labs

Physical Demands

• While performing the duties of this job, the employee is regularly required to stand, sit, walk, stoop and bend. The employee regularly uses hands for grasping and manipulating objects. The employee frequently lifts, carries and or moves up to 10 pounds. Specific vision abilities required by this job include close vision. Specific hearing required by this job includes normal tones. 
• Ability to work occasionally in inclement weather/temperature extremes.
• Ability to be flexible on short notice and may work extended hours/weekends/evenings when project demands. 
• Ability to work and collaborate across locations over different time zones.

This job description is not designed to cover or contain a comprehensive listing of activities, duties or responsibilities that are required of the employee. Duties, responsibilities and activities may change, or new ones may be assigned at any time with or without notice. 

Triple Point Security is an equal opportunity employer and does not discriminate on the basis of race, color, religion, sex, gender identity, sexual orientation, pregnancy, status as a parent, national origin, age, disability (physical or mental), family medical history or genetic information, political affiliation, and military service.