Principal Enterprise Security Architect (US Citizens or Green Card holders)

Please note that all applicants must be US Citizens or Green Card holders and no C2C candidates will be accepted. Summary: Tier One Technologies has an immediate need for a Principal Enterprise Security Architect for our US Government client. This remote contract-to-hire position can be originated in Falls Church, VA, Morrisville, NC or Eagan, MN. SELECTED CANDIDATES WITHOUT REQUIRED CLEARANCE WILL BE SUBJECT TO A FEDERAL GOVERNMENT BACKGROUND INVESTIGATION TO RECEIVE IT. Requirements: Serve as the strategic and technical bridge between Security Operations, CISO leadership, and Enterprise Infrastructure teams. Operate within the Corporate Information Security Office (CISO), collaborating directly with internal and external stakeholders to align corporate initiatives with robust cybersecurity strategies. Maintain and continuously enhance the enterprise security posture throughout ongoing infrastructure modernization and evolution toward the target architectural state. Identify structural security gaps across a hybrid environment encompassing multiple physical data centers and multi-cloud platforms and engineer resilient solutions to mitigate risks using security intelligence (SI) and large language models (LLMs). Serve as the primary security architecture advisor to CISO Engineering (CISO ENG), translating complex technical risks and structural vulnerabilities into clear, measurable business-risk metrics. Lead collaborative architecture design, threat modeling, and remediation sessions involving the CISO office, Network Engineering, Endpoint Management, and external vendors and partners. Develop and maintain the Enterprise Security Architecture roadmap, ensuring that security technology investments align with CISO objectives and business requirements across edge and network defense, cloud security, transport security, endpoint protection, and certificate lifecycle management. Leverage technical expertise and vendor solutions to advance security intelligence automation across the enterprise. Establish, implement, and enforce infrastructure security governance frameworks, standards, and policies. Manage and advise on the planning and operational execution of all CISO Engineering Security Edge workstreams. Conduct rigorous, proactive architectural reviews of the global hybrid infrastructure to identify structural weaknesses, supported by continuous monitoring and ongoing security assessments. Qualifications: Advanced degree in Computer Science, Cybersecurity, or a related engineering field preferred. BS degree from an accredited College/University in the applicable field of services is required, or 4 additional years of relevant experience in lieu of a college degree. 15+ years of experience with Edge and Perimeter Protection solutions and designs - IDS/IPS, WAF/WAAP, SDWAN remote security. 15+ years of experience with hands-on architectural experience across the entire technical scope: PKI, NDR, NGFW, WAAP, EDR/XDR, and SIEM), IDS/IPS, DNS Protection, Proxy, Webproxy, PAC, Loadbalancer, IP routing, Data Center designs. 10+ years of progressive experience in cybersecurity and infrastructure, with 5+ years in a dedicated architecture role directly influencing architectural decisions and priority. Expert knowledge of SASE/SSE Convergence – SDWAN, (CASB), Secure Web Gateways (SWG), and Zero Trust Network Access (ZTNA). Strong experience with Network service security and infrastructure – DNS security, PKI and CAOps, Proxy. Strong understanding of Zero Trust tenets and principles, and practical application of the principles. In-depth understanding of Security Framework Alignment: Map all infrastructure patterns to prevailing industry standards and best practices, specifically NIST CSF / SP 800-53 and the CIS Critical Security Controls. In-depth understanding of hybrid large scale enterprise: Strong history of assessing and securing complex enterprise environments spanning multiple physical data centers and comprehensive multi-cloud environments from various cloud service providers. (AWS, GCP, Azure). Experience with development and application of governance policy and standards in application of security tools, and Security Governance process/workstream management, while working to leverage SI to automate processes. Certifications Required: CCIE and CISSP. Desired Training: Microsoft Azure, GCP, AWS Fundamentals/Associate, Splunk, x-AI Fundamentals. Experience with security Incident response activities. Understanding AI application development methodology. Excellent communication skills. Must be a US Citizen or Permanent US Resident (Green Card Holder). Must be able to obtain Public Trust Clearance. Be able to pass a drug screening, criminal history, and credit checks. Must have lived in the United States for the past 5 years. Cannot have more than 6 months travel outside the United States within the last 5 years. Military Service excluded. (Exception does not include military family members.)