Senior Security Architect - Network Security

About the role

Established nearly two centuries ago, FM is a leading mutual insurance company whose capital, scientific research capability and engineering expertise are solely dedicated to property risk management and the resilience of its policyholder-owners. These owners, who share the belief that the majority of property loss is preventable, represent many of the world’s largest organizations, including one of every four Fortune 500 companies. They work with FM to better understand the hazards that can impact their business continuity to make cost-effective risk management decisions, combining property loss prevention with insurance protection.

Schedule & Location

Employment type: Full-time, salaried position

Location: Remote, within commutable distance of FM’s Corporate Office in Johnston, Rhode Island. On-site presence at the Corporate Office is expected 1 to 2 days per week, depending on business needs.

Relocation: Relocation assistance is not available for this position

Position Summary

Come join a newly formed team driving security architecture for a global Fortune 500 company. FM is building its Security Architecture function, and we're looking for a Senior Security Architect to be our subject matter expert for network security. Network security is your starting focus. As the function grows, your scope may expand into other security domains, based on your skills and the organization's needs.

In this role, you'll define how network security controls are designed, standardized and governed across a global network that supports dozens of locations in countries around the world. That includes today's offices, internet perimeters and private wide-area networks, and the cloud-first, software-delivered network we're moving toward, with Microsoft Azure at its center.

This is an individual contributor role for a forward-thinking architect with deep network security expertise and experience working in a modern cloud and DevOps environment. The ideal candidate connects the threat landscape to architecture decisions and sees the value of managing network and security configuration as code, but can also navigate the code itself or the management console to confirm that implemented configurations and architectures match design intent.

What You’ll Do

Set the standard: Define control design intent, technical standards and evaluation criteria for network security across our global environment. This covers next-generation firewalls (NGFWs), network segmentation, secure ingress and egress, web application firewalls (WAFs), DNS and edge protection, intrusion detection and prevention (IDS/IPS), SASE, ZTNA, and remote and branch access.

Build reusable patterns: Create reference architectures and patterns for on-premises, hybrid and Azure environments, including areas that don't have them today, so most work can move forward without case-by-case review.

Drive modernization: Own the network security strategy and roadmap, including our move toward secure access service edge (SASE), zero trust network access (ZTNA) and identity- and application-aware segmentation. Sequence the work to align with business direction and stay ahead of evolving threats.

Champion security as code: Promote infrastructure-as-code and configuration-as-code practices, along with CI/CD controls, so network and security changes are consistent, peer-reviewed, traceable and auditable.

Apply a risk-based approach: Translate security policy and risk intent into clear technical requirements, working with engineering teams to ensure requirements are practical, implementable and appropriate for the environment. Be clear about where controls are required, where they can be tailored and why.

Stay connected to implementation: Work closely with network security engineers to understand how designs are implemented in practice. Be comfortable reviewing configurations in firewall, SASE, WAF and cloud consoles and in code repositories, both to validate design intent and to identify opportunities to strengthen or evolve our architecture. Help define criteria for independent control validation and work with engineering teams to interpret and act on the findings.

Guide decisions: Review and approve designs, patterns and exceptions against defined criteria, document architecture decisions, and represent security in architecture review forums.

Collaborate across teams: Partner closely with enterprise architecture and with the network security, platform, and cloud engineers that operate security controls. Bring architectural perspective together with their hands-on expertise to develop solutions that are secure, practical and operable at scale. Stay close to implementation and work with engineering teams rather than operating platforms directly.

Anticipate threats: Keep up with adversary techniques, attacks on network edge and remote access, and changes in platforms and the industry, and design for where the environment is heading.

Communicate and mentor: Explain network security risk and requirements clearly to non-security audiences, and help develop other architects through coaching, design review and feedback

Qualifications

8 or more years of experience in IT or cybersecurity, with significant responsibility for network security architecture, engineering or design.

Experience designing resilient, redundant global network architectures, including SD-WAN, MPLS and hybrid connectivity.

Experience designing enterprise network security architectures, including NGFWs, segmentation, DMZs, secure ingress and egress, and IDS/IPS.

Architecture-level experience with enterprise NGFW platforms, and enough hands-on depth to assess configurations directly.

Strong Microsoft Azure network security experience, including virtual networks, network security groups, routing, private connectivity, and cloud ingress and egress.

Strong networking fundamentals, including BGP, routing, IPsec, VLAN/VRF, load balancing and troubleshooting complex traffic flows.

Experience with infrastructure as code, configuration as code, version control and CI/CD practices for network or security changes.

Experience designing zero trust segmentation and SASE/ZTNA architectures.

Understanding of the current threat landscape and how it informs network security architecture.

Familiarity with data protection and data loss prevention concepts, and with how network controls support them.

Familiarity with the risks of enterprise AI use. Experience with AI architectures or enterprise AI deployments is a plus but not required.

Experience creating reference architectures, reusable control patterns, exception criteria and decision records that hold up across teams.

Sound judgment in making and defending decisions when requirements conflict, and in knowing when to escalate.

Clear communication with technical and business audiences, and the ability to build agreement across engineering, platform, risk and product teams.

Education

Bachelor’s degree in computer science, information systems, engineering, cybersecurity, or a related field. A comparable combination of education and relevant experience may be considered. Even if your background doesn't match every requirement, we encourage you to apply.

The hiring range for this position is $138,000 - $198,000 a year. The final salary offer will vary based on geographic location, individual education, skills, and experience. The position is eligible to participate in FM’s comprehensive Total Rewards program that includes an incentive plan, medical, dental and vision insurance, life and disability insurance, well-being programs, a 401(k) and pension plan, career development opportunities, tuition reimbursement, flexible work, and time off, including vacation and sick time.

FM is an Equal Opportunity Employer and is committed to attracting, developing, and retaining a diverse workforce.

Posting text as published by FM.

The evidence behind this listing

Workplace

Remote Matched in posting text

Seniority

senior From the job title

Employment type

Not established

Location as listed

Johnston, Rhode Island, United States

Pay and work authorization

Stated pay

Not stated

Visa sponsorship

Not stated

Security clearance

Not established

Citizenship

Not established