Senior Director, Cybersecurity- Architecture

Job Description Summary:

The Senior Director, Cybersecurity Architecture serves as the senior-most cybersecurity architect in the enterprise, responsible for defining and driving the cybersecurity architecture vision, standards, and patterns that enable secure adoption of artificial intelligence, advanced analytics, cloud platforms, data-driven innovation, and modernized operational technology across a global, regulated business. 

This strategic technical leadership role bridges business strategy with technical execution, ensuring that security is embedded by design into the company's most critical transformations — including generative AI platforms, enterprise data ecosystems, multi-cloud migrations, Zero Trust initiatives, and digital and connected-health solutions. The role leads a team of specialized security architects, partners with Enterprise Architecture and business technology leaders, and serves as the authoritative voice on security architecture across the organization. 

The role demands deep technical expertise in modern cloud-native architectures, AI/ML security, data protection, identity, and Zero Trust principles, combined with the business acumen to translate complex security concepts into enabling strategies that accelerate innovation while managing risk in a highly regulated industry. 

Cybersecurity Domain Scope:

The Senior Director, Cybersecurity Architecture owns the security architecture across the following domains, setting direction for the architects and engineers who deliver in each area: 

• Enterprise AI & Data Security —  generative AI, machine learning platforms, LLMOps/MLOps, model governance, training-data protection, prompt injection prevention, AI agent security, enterprise data lakes, data mesh, and analytics platforms. 

• Cloud Security —  multi-cloud (AWS, Azure, GCP) and hybrid patterns, secure landing zones, Infrastructure-as-Code, DevSecOps pipelines, container and serverless workloads, SaaS, and API security. 

• Zero Trust & Identity —  Zero Trust Architecture aligned to NIST SP 800-207, enterprise identity fabric, privileged and non-human identity governance, passwordless and phishing-resistant MFA, ZTNA, and SASE. 

• OT & Manufacturing Security —  architectures aligned to the Purdue Model (ISA-95) and IEC 62443, industrial DMZ, OT/IT convergence, MES, SCADA, historians, PLCs/HMIs, and secure remote vendor access. 

• Architecture Governance —  Security Architecture Review Board (SARB), reference architectures, design patterns, threat modeling, and exception management aligned to NIST CSF, ISO 27001, and CIS. 

• Regulatory Context —  GxP, 21 CFR Part 11, EU Annex 11, ALCOA+, GDPR, HIPAA, and FDA cybersecurity guidance integrated into all architecture decisions. 

Typical Accountabilities:

Architecture Strategy, Direction & Standards

• Define the architecture strategy, direction, and standards pertinent for the cybersecurity architecture segment. 

• Analyze and translate business priorities and strategies into architecture requirements for the enterprise. 

• Act as an authority to the architecture community and the business regarding strategic architecture decisions for the cybersecurity segment. 

• Drive, review, approve, and oversee development and deployment of cybersecurity architecture roadmaps and blueprints (1–5 year horizon) as well as solution and segment architectures in alignment with global strategies and solutions. 

• Ensure continuous alignment of capabilities with current business priorities and objectives. 

• Contribute to strategic technology and architecture decisions as part of cross-functional decision-making bodies (e.g., SARB, Enterprise Architecture Review Board, IT Leadership Team). 

• Lead the development and implementation of Enterprise Architecture (EA) standards, processes, and tools as they apply to cybersecurity. 

• Engage with project and service teams in the development, implementation, and maintenance of standard architectural components. 

• Drive creation of functional design documents — including the risk and change management portions of the architectural lifecycle — across portfolios. 

Cross-Domain Resolution & Technical Counsel:

• Lead resolution of complex cross-domain and technical concerns, needs, and suggestions from business teams across portfolios to improve architecture design and mitigate risk. 

• Act as strategic architectural advisor and provide technical counsel to global leadership teams — both business and IT — on potential business-critical enterprise needs and risks. 

• Present strategic recommendations for systemic, structural, and technology solutions to executive leadership, including the CISO, CIO, and Audit Committee where appropriate. 

• Lead Security Architecture Review Board (SARB) activity for major initiatives and technology investments, ensuring consistent, risk-based architecture decisions. 

• Conduct architecture risk assessments and threat modeling for critical systems and initiatives; manage architecture exceptions and waivers with documented risk acceptance. 

Third-Party & Supplier Direction:

• Provide direction to third-party suppliers to ensure adherence to technical development and delivery aligned with the architecture roadmap, blueprint, and information systems strategy. 

• Evaluate vendor security architectures for major technology procurements; influence vendor roadmaps to address industry and regulatory security requirements. 

• Establish secure integration patterns with strategic partners, contract research and manufacturing organizations, and external collaborators. 

Performance, Measurement & Reporting:

• Direct and drive monitoring, measurement, and reporting around the performance of current and upgraded architecture, systems, solutions, and frameworks across portfolios. 

• Maintain an architecture repository with patterns, standards, approved designs, and security control mappings to compliance frameworks and audit requirements. 

• Track adoption of published security architecture standards and reference architectures; report on maturity, exception volume, and risk posture to leadership. 

Innovation, Best Practices & Thought Leadership:

• Monitor and identify IT architecture best practices and emerging technologies regionally and globally to facilitate enterprise technology decisions. 

• Evaluate security implications of emerging technologies — quantum computing, post-quantum cryptography, edge AI, blockchain, and conduct proof-of-concept architectures. 

• Serve as a recognized thought leader within and beyond the organization, typically with leadership roles in multi-institution collaborations. 

• Represent the company at industry forums, standards bodies, and peer working groups (e.g., Pharma ISAC, IEC 62443 working groups). 

Talent Pipeline & Architecture Capability:

• Actively monitor the strength of the IT architecture talent pipeline. 

• Propose and implement strategic future-focused skill-development interventions across areas through cross-functional, regional, and external partnerships to equip and adapt the IT architecture workforce to evolving technologies. 

• Define security-architect competency models and career progression pathways; facilitate an architecture community of practice for knowledge sharing across the organization. 

As a People Manager:

• Develop, deliver, and monitor budgets — including capital — for the cybersecurity architecture segment. 

• Collaborate with business and regional leaders for prioritization and alignment of segment IT architecture strategy, goals, and projects. 

• Build, lead, and motivate IT architecture teams to achieve stretch goals. 

• Develop the professional and leadership capabilities of IT architecture professionals and managers through coaching, delegation, development plans, stretch assignments, and rotations. 

• Lead and mentor a team of specialized security architects (Cloud Security, AI/Data Security, OT/ICS Security, Application Security, Infrastructure Security). 

Qualifications:

Education & Experience

• Bachelor's degree in relevant technical field of study; Master's preferred. 

• Minimum 10+ years of experience

• Preferred certifications: CISSP, CCSP, SABSA; cloud-platform security specialty certifications (AWS, Azure, GCP); GIAC Security Architecture or Cloud Security; CISM. 

Architecture & Technical Experience

• Proven experience in architecture method execution. 

• Significant experience in development and design across technical domains. 

• Extensive experience defining and aligning architectural roadmaps and strategies to business strategy. 

• Experience with rationalization, consolidation, and integration across business domains using a formal framework. 

• Experience with large justification-phase work — product evaluation and business case formulation. 

• Experience defining and developing components of an enterprise architecture practice. 

• Experience engaging and negotiating with third-party suppliers. 

Leadership & Stakeholder Experience

• Experience influencing cross-functional global leadership and other senior stakeholders to adopt change or innovative IT solutions. 

• Extensive experience managing geographically dispersed teams in a global matrix organization with direct and indirect reports — providing oversight, guidance, and mentoring. 

• Extensive experience working across boundaries — internally, cross-functionally, externally, internationally, and cross-culturally. 

• Experience planning and managing budgets and resources for a large IT infrastructure function. 

• Experience co-working with cross-functional global leadership and other senior stakeholders preferred. 

• Substantial experience communicating with and influencing diverse internal and external stakeholders, including supplier and vendor networks, across areas and geographies, to drive infrastructure strategy and outcomes. 

• Substantial experience anticipating, assessing, and managing project risks.

​

Domain Expertise (Preferred)

• 15+ years in information security with 10+ years focused on security architecture and engineering; 5+ years in leadership roles. 

• Deep expertise in cloud security architecture (AWS, Azure, GCP) including multi-cloud and hybrid cloud patterns, IaC and DevSecOps, container and serverless security. 

• Proven experience with AI/ML and generative-AI security — model security, adversarial ML, data protection, AI governance, prompt-injection defense, AI-agent security. 

• Strong background in data security architecture for enterprise data platforms, analytics, and data governance (classification, encryption, tokenization, DLP, privacy-enhancing technologies). 

• Experience with Zero Trust Architecture design and implementation; identity fabric, PAM, NHI governance, passwordless authentication, ZTNA/SASE. 

• Knowledge of OT/ICS security architecture for manufacturing or critical-infrastructure environments (Purdue Model, IEC 62443) — pharmaceutical experience highly desirable. 

• Familiarity with regulated-industry requirements (GxP, 21 CFR Part 11, EU Annex 11, ALCOA+, CSV/CSA, GDPR, HIPAA) and ability to design controls that satisfy them without impeding innovation. 

Key Relationships:

Direct Reports

• Cloud Security Architect(s) 

• AI / Data Security Architect(s) 

• OT / ICS Security Architect(s) 

Internal Stakeholders

• Executive Director, Cybersecurity Engineering, Architecture & Transformation (manager) 

• CISO and CISO Leadership Team 

• Business Information Security Officer (BISO) leads 

• Security Operations Center leadership; GRC; Cybersecurity Engineering teams 

• Enterprise Architecture; Cloud, Data, and AI/ML platform teams 

• Business Technology Groups (R&D, Manufacturing, Commercial, Enabling Units) and Centers of Excellence 

External Stakeholders

• Cloud service providers (AWS, Azure, GCP) and strategic technology vendors 

• Industry peers in pharmaceutical CISO and architecture communities 

• Standards bodies and industry forums (e.g., Pharma ISAC, IEC 62443 working groups) 

Working Conditions & Travel:

• Hybrid work model with flexibility for remote work; office presence as needed for collaboration. 

• Occasional work outside standard business hours for global collaboration and incident response. 

• 15–25% domestic and international travel — site visits to manufacturing facilities, data centers, regional offices, industry conferences, and architecture workshops. 

Why This Role Matters:

• Shape the future of cybersecurity for a global, science-led organization undergoing AI and digital transformation. 

• Enable innovation by designing security architectures that accelerate — rather than impede — business outcomes. 

• Protect patients, people, and intellectual property by ensuring the integrity of systems that discover, develop, manufacture, and deliver life-changing medicines. 

• Build world-class architecture capability by developing the next generation of security architects. 

• Influence the industry through thought leadership, standards contributions, and peer collaboration. 

When we put unexpected teams in the same room, we unleash bold thinking with the power to encourage life-changing medicines. In-person working gives us the platform we need to connect, work at pace and challenge perceptions. That's why we work, on average, a minimum of three days per week from the office. But that doesn't mean we're not flexible. We balance the expectation of being in the office while respecting individual flexibility. Join us in our unique and ambitious world.

The annual base pay for this position ranges from $190,956.80 - $286,435.20  USD Annual. Hourly and salaried non-exempt employees will also be paid overtime pay when working qualifying overtime hours. Base pay offered may vary depending on multiple individualized factors, including market location, job-related knowledge, skills, and experience. In addition, our positions offer a short-term incentive bonus opportunity; eligibility to participate in our equity-based long-term incentive program (salaried roles), to receive a retirement contribution (hourly roles), and commission payment eligibility (sales roles). Benefits offered included a qualified retirement program [401(k) plan]; paid vacation and holidays; paid leaves; and, health benefits including medical, prescription drug, dental, and vision coverage in accordance with the terms and conditions of the applicable plans. Additional details of participation in these benefit plans will be provided if an employee receives an offer of employment. If hired, employee will be in an “at-will position” and the Company reserves the right to modify base pay (as well as any other discretionary payment or compensation program) at any time, including for reasons related to individual performance, Company or individual department/team performance, and market factors.

Are you ready to bring new insights and fresh thinking to the table?Fantastic! We have one seat available, and we hope it’s yours. Apply today.

AstraZeneca embraces diversity and equality of opportunity. We are committed to building an inclusive and diverse team representing all backgrounds, with as wide a range of perspectives as possible, and harnessing industry-leading skills. We believe that the more inclusive we are, the better our work will be. We welcome and consider applications to join our team from all qualified candidates, regardless of their characteristics. We follow all applicable laws and regulations on non-discrimination in employment (and recruitment), as well as work authorization and employment eligibility verification requirements.

Date Posted

Closing Date

Our mission is to build an inclusive environment where equal employment opportunities are available to all applicants and employees. In furtherance of that mission, we welcome and consider applications from all qualified candidates, regardless of their protected characteristics. If you have a disability or special need that requires accommodation, please complete the corresponding section in the application form.