Security Architecture Manager
PwC is driving major change across information and cyber security by building a centralized model to provide security services across the entire member firm network.
Mandated at the network level, Network Information Security (NIS) operates outside Information Technology (IT) and is responsible for this major program initiative, from definition of the security strategy to execution of the global Cyber Readiness Program, moving from local to centralized services.
Our mission is to identify, control and reduce the attack surface across the member firm network while increasing our adversaries’ cost of attack.
In order to deliver the Cyber Readiness Program the NIS team is structured into the following Pillars:
Information Security Risk and Compliance (ISRC)
Chief Information Security Office (CISO)
Security Architecture, Engineering, Innovation and Transformation (SAEIT)
Cyber Security Services
Strategy and Alliances
Chief of Staff
NIS is building the first global cyber security function at PwC. Our mission protects 300,000 PwC members across 160 member firms worldwide as well as our global clients.
If you are seeking an exciting career with the scope to grow your security skills through major change on a global scale, then NIS will empower you to do so.
The SAEIT pillar within NIS is responsible for the following services:
If you love designing and building security technology this is the place to be. Within SAEIT we work closely with the business to define the NIS 5 year security roadmap. Gathering business requirements to combine PwC’s goals with conceptual long term security trends to create a target architecture for NIS to deliver against. From this future state plan the Security Engineering team break down long term goals into manageable projects and look to technical security solutions to solve business problems. Designing and building security technology that span the wider PwC network of firms. Once security technologies are built the security engineering team work closely with Cyber in order to highlight the capability of the technology to ensure maximum impact as it is transitioned into an operational environment.
Scope of Responsibility:
The Security Architecture team is responsible for the following tasks:
Identifying long term security trends and developing proof of concept designs to establish feasibility of execution within the business;
Engaging business and technology stakeholders at all levels to gather long term goals and requirements;
Mapping long term business requirements to complex security architecture frameworks;
Definition of NIS Security architecture roadmap and documentation of enterprise security framework; and
Engagement with Security Engineering to ensure solution design and build in line with long term security strategy.
Strategic and Technical Orientation / Job Content:
SAEIT pillar skills matrix:
Experience engaging business and technology stakeholders at all levels to gather long term goals and requirements;
Experience mapping long term business requirements to security architecture frameworks such as The Open Group Architecture Framework (TOGAF), Sherwood Applied Business Security Architecture (SABSA), Zachman etc.;
Understanding of how to design and build security technology solutions aligned to a global central service environment;
Understanding of security technology at an enterprise and solution level;
Hands on engineering experience with enterprise security technology;
Experience contributing to a central technology service organization;
Navigating a matrix organization; and
Experience collaborating with multiple stakeholders across functional and technical skillsets.
Range of Impact:
A 3E Level employee possesses deep knowledge in a specific subject matter area or technical domain related to Security Architecture that is applied in the context of a broader understanding of the functional area and related systems and processes.
The candidate will contribute to the development of new subject matter/technical domain expertise within the Security Architecture space.
A 3E resolves challenging problems by continuously applying significant independent judgment and by collaborating with others, and influences others through a small team of direct reports, through work on projects and in teams, and/or through leading portions of larger projects.
Demonstrates extensive-level abilities within Security Architecture.
Encourages improvement and innovation within Security Architecture and nurturing and developing less-experienced staff through coaching and written/verbal feedback.
Performs Security Architecture tasks with autonomy.
Capture and documentation of future goals of the business
Application of security concepts to define future state security roadmap
Analysis and alignment of security technology environment with future state security roadmap
Integration of information security controls framework with future state security technology landscape
Driving informed decision making on security technology
Reduction of enterprise information security risks aligned to security technology service model,
Detailed documentation security architecture process
An effective SAEIT candidate will also possess the following skills:
Analytical: Inquisitive nature and intuition regarding what questions to ask, when, and their relative significance.
Technical: Broad understanding of enterprise technology and how to design and build a range of security tools
Business: High level understanding of PwC’s business model, service offerings, and business operating environment as it pertains to the firm’s threat landscape. Ability to frame threats and exposures in a business context recognized by non-technical staff and executives.
Threat landscape: Knowledge of how attack techniques are used in enterprise intrusions to gain entry, gain privilege, and ultimately accomplish a nefarious objective against a victim organization.
Communication: High level verbal and written communication skills vital to informing, persuading, and teaching stakeholders to enable effective response
Delivery. Ability to define the conceptual and execute within a real world business environment.