Foxtrot Division

Security Engineer

• Serve as the lead architect and subject matter expert for enterprise security strategy, design, and modernization across on-premises, managed hosting, hybrid, and cloud environments.
• Define and maintain a cohesive, layered security architecture that clearly establishes trust boundaries, control placement, security responsibilities, and where prevention, detection, response, and visibility should occur throughout the environment.
• Establish standardized front-door patterns for externally accessible applications and services using technologies such as F5 BIG-IP, Akamai, cloud-native web application firewalls, and other approved edge-security controls.
• Develop phased migration strategies to place existing public-facing websites and applications behind approved enterprise ingress and application-security services, including workloads hosted in data centers, managed hosting environments, Microsoft Azure, and Amazon Web Services.
• Identify and address direct-to-origin exposure and other paths that could allow traffic to bypass approved application delivery, certificate management, logging, or security controls.
• Design secure and resilient enterprise ingress and egress architectures, including additional egress capabilities, security service chaining, load-balancer-based architectures, centralized certificate management, and highly available traffic-management patterns.
• Evaluate the effectiveness of border, upstream, mid-tier, and downstream firewall controls. Identify opportunities to simplify rule sets, eliminate unnecessarily permissive access, improve early-path blocking, and reduce the operational burden placed on downstream security platforms.
• Validate whether network and application-security controls are operating as intended through architecture reviews, configuration analysis, traffic-flow validation, and telemetry assessment. Collaborate with service providers and engineering teams to identify enforcement, visibility, and ownership gaps across security layers.
• Establish and lead an enterprise PKI architecture, including certificate authority and trust models, certificate enrollment and issuance, key protection, revocation, lifecycle management, governance, automation, and integration with enterprise and cloud-hosted systems.
• Define enterprise IAM architecture patterns addressing authentication, authorization, identity federation, privileged access, machine and workload identities, network access control, and the integration of identity context with infrastructure and application-security controls.
• Provide architectural oversight and hands-on technical guidance for technologies including Cisco ASA, Cisco Identity Services Engine, Palo Alto Networks next-generation firewalls, F5 BIG-IP, IAM platforms, web application firewalls, and related enterprise security capabilities.
• Define reusable security architecture patterns for Azure and AWS, including secure ingress and egress, network segmentation, cloud WAF services, identity integration, certificate management, security logging, and connectivity to enterprise security platforms.
• Provide security architecture leadership for the modernization of large-scale WAN and MPLS-based network environments, including segmentation, resiliency, routing, inspection points, traffic flows, availability requirements, and future-state security objectives.
• Develop an enterprise strategy for encrypted traffic inspection and TLS decryption at scale. Determine appropriate inspection locations while accounting for security value, application compatibility, privacy, performance, availability, certificate handling, and exception management.
• Define and optimize the role of Gigamon and similar network-packet-brokering technologies within the enterprise visibility architecture, including traffic collection points, filtering, replication, optimization, and distribution to SIEM, NDR, threat-hunting, and analytics platforms.
• Lead the development of a future-state SIEM, logging, and security-telemetry architecture. Evaluate centralized logging, security data lakes, telemetry pipelines, and platforms such as Cribl while balancing security value, signal quality, scalability, retention, cost, and operational overhead.
• Incorporate infrastructure-as-code, policy-as-code, configuration management, version control, automated testing, and repeatable deployment principles into enterprise security architecture and operational patterns.
• Develop current-state and target-state architecture diagrams, security reference architectures, technical standards, data-flow diagrams, decision records, implementation guidance, and phased modernization roadmaps.
• Communicate complex security architecture concepts, risks, tradeoffs, and recommendations to executive leadership, engineering teams, security operations personnel, application owners, service providers, and other technical and nontechnical stakeholders.

Enterprise Security Architect