Principal Cybersecurity Architect - Lab & Customer Infrastructure

MatchPoint Solutions is a fast-growing, young, energetic global IT-Engineering services company with clients across the US . We provide technology solutions to various clients like Uber, Robinhood, Netflix, Airbnb, Google, Sephora, and more! More recently, we have expanded to working internationally in Canada, China, Ireland, UK, Brazil, and India . Through our culture of innovation, we inspire, build, and deliver business results, from idea to outcome. We keep our clients on the cutting edge of the latest technologies and provide solutions by using industry-specific best practices and expertise.

We are excited to be continuously expanding our team. If you are interested in this position, please send over your updated resume. We look forward to hearing from you!

Principal Cybersecurity Architect - Lab & Customer Infrastructure

Remote

6 months

Pay rate: $90 to 100/hr

Where candidates have fallen short:

Governance and policy without hands-on depth.

• Several candidates communicate well at the leadership level but couldn't get into technical controls. For example, securing non-human identities came down to ownership and audit processes, not controls like MFA, certificate-based auth, or secret stores.

Narrow platform experience.

• Some candidates' identity experience is limited to M365/Entra. They lacked experience across multiple platforms and auth approaches, including device trust based on device compliance.
  Gaps on current concepts.
• Phishing-resistant MFA was unfamiliar to some candidates. Others couldn't explain it to non-technical leaders or developers.

Top-down approach.

• Some candidates would work only through the CISO and enterprise architecture. They wouldn't work with identity engineers and SMEs to build the architecture together.

What we're looking for:

• Recent, hands-on identity architecture experience: workforce and non-human identities (service principals, managed identities, secrets and privileged access management), phishing-resistant MFA, and device trust.
  Experience across multiple platforms, not a single ecosystem.
• Someone who designs with engineers and stakeholders, resolving conflicts in real time, and can hold their own with our strongest engineers.
• Consulting-ready communication, able to explain the same concept to a CISO, a developer, and a non-technical leader.

Role Summary

• Information Security is looking for a Security Architect to design and govern security across our customer-facing lab environments - the infrastructure we provision for customers to connect into, test configurations, stage equipment, and prepare for datacenter deployments. This is a hands-on architecture role at the intersection of network security, infrastructure engineering, and customer-facing operations.

Context

• Our lab environments serve multiple simultaneous customers, each connecting into dedicated segments to test infrastructure configurations, evaluate solutions, or stage physical and virtual equipment before it ships to their datacenters. This creates a unique security challenge: strict multi-tenant isolation, controlled external access, supply chain integrity for outbound hardware, and a constantly shifting topology as customer environments are provisioned and decommissioned.

Responsibilities

Multi-Tenant Environment Security & Isolation

• Design and enforce security segmentation between customer lab environments - ensuring no customer can reach another's segment through any path, intentional or accidental
• Define the network security architecture for the lab: VLANs, micro-segmentation, firewall zoning, and inter-VLAN routing controls - with a zero-trust posture between tenant segments
• Develop and maintain a customer environment provisioning security standard - covering how new lab environments are stood up, validated for isolation, and decommissioned cleanly without data or configuration remnants
• Lead regular isolation validation exercises: penetration testing of tenant boundaries, traffic analysis, and configuration audits

Customer Connectivity & External Access

• Architect secure connectivity options for customers accessing lab environments remotely: ZTNA, IPSec/SSL VPN, MPLS/dedicated circuit - selecting appropriate models based on customer security requirements and sensitivity of the work
• Define onboarding standards for external parties: identity verification, access scoping, MFA requirements, and time-limited access windows
• Design and operate a secure remote access gateway that logs all customer sessions, enforces least-privilege network access, and integrates with the broader security monitoring stack

MatchPoint Solutions provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws.

This policy applies to all terms and conditions of employment, including recruiting, hiring, placement, promotion, termination, layoff, recall, transfer, leaves of absence, compensation, and training.