Information Security- Security Architect- Hindustan Unilever
MAIN PURPOSE OF SECURITY ARCHITECT
The Security Architect is responsible for developing and maintaining appropriate technology road maps and security reference architecture to support the design and implementation of key IT foundational and CSRM platforms. The role requires in-depth technical knowledge of foundational platform architectures in order to evaluate appropriate technologies and optimise the use of existing capabilities and platforms. The Security Architect will work as part of a team of platform analysts and SMEs to define and maintain end-to-end security architecture for the CSRM and provide architecture support to the wider business. Key to the role is the introduction of new ideas and security technologies which support business innovation and growth and the definitions and maintenance of future-fit security architecture principles and standards.
The main accountability of this role is to define, deliver and maintain future-fit information security architecture principles, standards, building blocks and technology roadmaps to support the secure design and implementation of foundational and cloud platforms.
- Support the Senior Security Architects to develop a future-fit security architecture strategy and ensure alignment and prioritisation of activities across the CSRM function.
- Provide support and subject matter expertise across a range of domains for projects and platforms in order to drive the delivery of key strategic programmes and leverage existing capabilities.
- Maintain a deep understanding of the information security landscape and emerging technologies and identify key implications and actions for Unilever security architecture.
- Define and maintain a set of relevant and up to date security architecture principles and standards and building blocks.
- Develop business-relevant and future-fit technology roadmaps for CSRM, with a particular focus on security operations (detection and response, threat hunting, incident and event management etc.) and endpoint security (including Internet of Things) and select the technologies and tools required for the delivery of the cybersecurity destination architecture in partnership with Enterprise Architecture to ensure strategic alignment.
- Help determine the information security requirements that must be present to ensure that all IT projects are aligned to information security strategy and assist with the communication of these to IT and business stakeholders.
- Support key security initiatives in Unilever’s factories and network security enhancements.
- Deliver KPIs/metrics for a security architecture for management reporting to colleagues and stakeholders.
ADVISORY, ENGAGEMENT AND DEVELOPMENT
- Offer internal consultancy advice and assistance to the CSRM function and wider business on all matters relating to security architecture and ensure the correct level of engagement and support for all major projects/programmes.
- Alignment with all areas of the CSRM team to ensure requirements for technology and solutions are understood adequate visibility of project engagements and to request and collate review of all solution designs across the team.
- Establish and maintain links with industry vendors and identify innovative security opportunities for Unilever from early adoption.
- Support, manage and mentor junior team members to ensure delivery of security architecture in Unilever.
Up to 1 full-time employee
- Senior Security Architect
- CSRM team – all areas
- Enterprise and Infrastructure Architecture
- Programme and Project Managers
- IT Infrastructure, Capability and Application Teams
- IT Platform Owners
- Vendors and Partners
- Factory Cyber Security Programme
Critical Success Factors for the Job
Essential Experience / Skills
- Experience across a variety of foundational and infrastructure platforms and security capabilities and significant experience in at least two of the following domains: network security and intrusion detection and prevention, endpoint detection and response (including Internet of Things), security incident response and operations (including SIEM/SOAR tooling), cloud security architecture, DevSecOps and secure software development; and Microsoft 365 security architecture.
- Broad knowledge of IT technology platforms and security capabilities across a range of domains.
- Experience of defining architectural principles, standards, and roadmaps to support business objectives
- Experience working in a large complex business environment requiring strategic impact, taking balanced risk decisions, and management of stakeholder pressures.
- Successful track record of building relationships with key stakeholders across the IT and business environment and with external suppliers/partners.
- Excellent communication and stakeholder management with a demonstrable ability to communicate complex ideas to, and build successful relationships with, stakeholders at all levels.
- Ability to work independently and as part of a team to delivering work at pace and meet deadlines
- Agility and ability to assimilate new technologies and assess their strengths, weaknesses and strategic benefit.
- Ability to articulate the benefits of optimised security with the cost of providing it, to promote the best overall interests of the business.
- Relevant certification in security architecture, e.g. SABSA or CISSP-ISSAP.
- Implementation of a detailed information security reference architecture and framework within a large complex organisation.
- Experience of applying pragmatic and effective controls in operational technology environments.
- Knowledge and demonstrable experience of securing operational technology environments in a large complex organisation.
- Experience within a consumer goods or retail environment.
- Degree level of education.
- Experience of leading large projects to implement security tools and technologies.
- Experience of deploying endpoint detection and response solutions across large environments
- Experience of deploying network traffic analysis capabilities
- Experience of working in security operations
- Experience of DevSecOps