In this role, you'll define how network security controls are designed, standardized and governed across a global network that supports dozens of locations in countries around the world. That includes today's offices, internet perimeters and private wide-area networks, and the cloud-first, software-delivered network we're moving toward, with Microsoft Azure at its center.
This is an individual contributor role for a forward-thinking architect with deep network security expertise and experience working in a modern cloud and DevOps environment. The ideal candidate connects the threat landscape to architecture decisions and sees the value of managing network and security configuration as code, but can also navigate the code itself or the management console to confirm that implemented configurations and architectures match design intent.
What You’ll Do
Set the standard: Define control design intent, technical standards and evaluation criteria for network security across our global environment. This covers next-generation firewalls (NGFWs), network segmentation, secure ingress and egress, web application firewalls (WAFs), DNS and edge protection, intrusion detection and prevention (IDS/IPS), SASE, ZTNA, and remote and branch access.
Build reusable patterns: Create reference architectures and patterns for on-premises, hybrid and Azure environments, including areas that don't have them today, so most work can move forward without case-by-case review.
Drive modernization: Own the network security strategy and roadmap, including our move toward secure access service edge (SASE), zero trust network access (ZTNA) and identity- and application-aware segmentation. Sequence the work to align with business direction and stay ahead of evolving threats.
Champion security as code: Promote infrastructure-as-code and configuration-as-code practices, along with CI/CD controls, so network and security changes are consistent, peer-reviewed, traceable and auditable.
Apply a risk-based approach: Translate security policy and risk intent into clear technical requirements, working with engineering teams to ensure requirements are practical, implementable and appropriate for the environment. Be clear about where controls are required, where they can be tailored and why.
Stay connected to implementation: Work closely with network security engineers to understand how designs are implemented in practice. Be comfortable reviewing configurations in firewall, SASE, WAF and cloud consoles and in code repositories, both to validate design intent and to identify opportunities to strengthen or evolve our architecture. Help define criteria for independent control validation and work with engineering teams to interpret and act on the findings.
Guide decisions: Review and approve designs, patterns and exceptions against defined criteria, document architecture decisions, and represent security in architecture review forums.
Collaborate across teams: Partner closely with enterprise architecture and with the network security, platform, and cloud engineers that operate security controls. Bring architectural perspective together with their hands-on expertise to develop solutions that are secure, practical and operable at scale. Stay close to implementation and work with engineering teams rather than operating platforms directly.
Anticipate threats: Keep up with adversary techniques, attacks on network edge and remote access, and changes in platforms and the industry, and design for where the environment is heading.
Communicate and mentor: Explain network security risk and requirements clearly to non-security audiences, and help develop other architects through coaching, design review and feedback
Qualifications
8 or more years of experience in IT or cybersecurity, with significant responsibility for network security architecture, engineering or design.
Experience designing resilient, redundant global network architectures, including SD-WAN, MPLS and hybrid connectivity.
Experience designing enterprise network security architectures, including NGFWs, segmentation, DMZs, secure ingress and egress, and IDS/IPS.
Architecture-level experience with enterprise NGFW platforms, and enough hands-on depth to assess configurations directly.
Strong Microsoft Azure network security experience, including virtual networks, network security groups, routing, private connectivity, and cloud ingress and egress.
Strong networking fundamentals, including BGP, routing, IPsec, VLAN/VRF, load balancing and troubleshooting complex traffic flows.
Experience with infrastructure as code, configuration as code, version control and CI/CD practices for network or security changes.
Experience designing zero trust segmentation and SASE/ZTNA architectures.
Understanding of the current threat landscape and how it informs network security architecture.
Familiarity with data protection and data loss prevention concepts, and with how network controls support them.
Familiarity with the risks of enterprise AI use. Experience with AI architectures or enterprise AI deployments is a plus but not required.
Experience creating reference architectures, reusable control patterns, exception criteria and decision records that hold up across teams.
Sound judgment in making and defending decisions when requirements conflict, and in knowing when to escalate.
Clear communication with technical and business audiences, and the ability to build agreement across engineering, platform, risk and product teams.
Education
Bachelor’s degree in computer science, information systems, engineering, cybersecurity, or a related field. A comparable combination of education and relevant experience may be considered. Even if your background doesn't match every requirement, we encourage you to apply.
The hiring range for this position is $138,000 - $198,000 a year. The final salary offer will vary based on geographic location, individual education, skills, and experience. The position is eligible to participate in FM’s comprehensive Total Rewards program that includes an incentive plan, medical, dental and vision insurance, life and disability insurance, well-being programs, a 401(k) and pension plan, career development opportunities, tuition reimbursement, flexible work, and time off, including vacation and sick time.
FM is an Equal Opportunity Employer and is committed to attracting, developing, and retaining a diverse workforce.
8 or more years of experience in IT or cybersecurity, with significant responsibility for network security architecture, engineering or design.
Experience designing resilient, redundant global network architectures, including SD-WAN, MPLS and hybrid connectivity.
Experience designing enterprise network security architectures, including NGFWs, segmentation, DMZs, secure ingress and egress, and IDS/IPS.
Architecture-level experience with enterprise NGFW platforms, and enough hands-on depth to assess configurations directly.
Strong Microsoft Azure network security experience, including virtual networks, network security groups, routing, private connectivity, and cloud ingress and egress.
Strong networking fundamentals, including BGP, routing, IPsec, VLAN/VRF, load balancing and troubleshooting complex traffic flows.
Experience with infrastructure as code, configuration as code, version control and CI/CD practices for network or security changes.
Experience designing zero trust segmentation and SASE/ZTNA architectures.
Understanding of the current threat landscape and how it informs network security architecture.
Familiarity with data protection and data loss prevention concepts, and with how network controls support them.
Familiarity with the risks of enterprise AI use. Experience with AI architectures or enterprise AI deployments is a plus but not required.
Experience creating reference architectures, reusable control patterns, exception criteria and decision records that hold up across teams.
Sound judgment in making and defending decisions when requirements conflict, and in knowing when to escalate.
Clear communication with technical and business audiences, and the ability to build agreement across engineering, platform, risk and product teams.
Education
Bachelor’s degree in computer science, information systems, engineering, cybersecurity, or a related field. A comparable combination of education and relevant experience may be considered. Even if your background doesn't match every requirement, we encourage you to apply.
The hiring range for this position is $138,000 - $198,000 a year. The final salary offer will vary based on geographic location, individual education, skills, and experience. The position is eligible to participate in FM’s comprehensive Total Rewards program that includes an incentive plan, medical, dental and vision insurance, life and disability insurance, well-being programs, a 401(k) and pension plan, career development opportunities, tuition reimbursement, flexible work, and time off, including vacation and sick time.
FM is an Equal Opportunity Employer and is committed to attracting, developing, and retaining a diverse workforce.
