Principal Security Architecture - Digital Solutions

About the role

Lead the security architecture, standards, and governance for customer- and employee-facing digital platforms and enabling services. Ensure solutions are secure by design, compliant with regulatory requirements, and resilient to evolving threats. Shape the roadmap for foundational security capabilities across the digital portfolio, including secure adoption of GenAI.

Responsibilities

• Perform end-to-end security architecture reviews for digital solutions (web, mobile, APIs, microservices, integrations) and drive risk treatment.
• Maintain reference architectures, secure patterns, and standards across IAM, data, network, cloud, and third-party/SaaS.
• Conduct threat modeling and security risk assessments (e.g., OWASP, API abuse, supply chain threats).
• Evolv the digital security architecture roadmap aligned to business priorities, regulation, and measurable risk reduction.
• Enable security in CI/CD and SDLC (secure coding guidance, security testing, cloud-native guardrails).
• Communicate recommendations clearly to engineers and leadership; influence design decisions and risk acceptance outcomes.

Requirements

• Minimum Qualifications: 7+ years of relevant experience, Bachelor’s Degree in Computer Science, Information Security, or related field.
• Preferred Qualifications: Master’s in Computer Science, Information Security, or related field, 5+ years in security architecture, strong digital application security and cloud experience, proven ability to mentor/coach, demonstrated Financial Services experience, deep expertise in IAM, network security, data protection, and SaaS/third-party risk, experience with security reviews, threat modeling, and technology/vendor evaluations, knowledge of financial regulatory frameworks, strong communication and stakeholder management skills, certifications (e.g., CISSP, CCSP, AWS/Azure Security, CISM, TOGAF) desirable, GenAI/LLM security knowledge, regulated-environment experience preferred.

Qualifications

• Minimum Qualifications: 7+ years of relevant experience, Bachelor’s Degree in Computer Science, Information Security, or related field.
• Preferred Qualifications: Master’s in Computer Science, Information Security, or related field, 5+ years in security architecture, strong digital application security and cloud experience, proven ability to mentor/coach, demonstrated Financial Services experience, deep expertise in IAM, network security, data protection, and SaaS/third-party risk, experience with security reviews, threat modeling, and technology/vendor evaluations, knowledge of financial regulatory frameworks, strong communication and stakeholder management skills, certifications (e.g., CISSP, CCSP, AWS/Azure Security, CISM, TOGAF) desirable, GenAI/LLM security knowledge, regulated-environment experience preferred.

Skills

• IAM: authentication/authorization, federation/SSO, least privilege, service-to-service identity.
• Network: segmentation, ingress/egress controls, API gateway/WAF, DDoS, secure connectivity.
• Data: classification, encryption, tokenization/masking (where applicable), key/secrets management.
• Cloud: AWS/Azure secure baselines and architecture patterns aligned to organizational standards.
• Third-party/SaaS: security due diligence, onboarding/contractual security controls, monitoring, and ongoing assurance.
• Application Security: establish integration security standards (API schemas, mTLS/OAuth2/OIDC patterns, token storage/rotation, webhook security, idempotency/replay protections, and rate limiting/abuse detection).
• GenAI Security: define secure GenAI patterns (LLM access controls, prompt/response handling, RAG security, agent/tooling boundaries), threat model GenAI use cases (prompt injection, data leakage, model extraction/poisoning, unsafe output handling), set GenAI data governance requirements (sensitive data use, retention, auditability) and vendor/model assurance expectations.

Benefits

• Time Away: 20 paid time off days in addition to 11 paid holidays and 8 hours of volunteer time off yearly.
• Planning for the Future: industry-leading 401K retirement savings plan with matching and company contributions, student loan pay downs and 529 educational save up assistance programs, tuition reimbursement, employee stock purchase plan, and financial learning center and financial coach access.
• Supporting your Health & Well-being: flexible health and insurance options including medical, dental and vision, employee, spouse and child life insurance, short- and long-term disability, pre-tax Health Savings Account with employer contributions, Healthcare FSA, critical illness, accident & hospital indemnity insurance, and a total well-being program that helps you and your family stay on track physically, socially, emotionally, and financially.
• Building a Family: adoption, surrogacy and fertility assistance as well as paid parental and caregiver leave, Dependent Day Care FSA back-up child and adult/elder care days and childcare discounts.
• Work-Life Integration: Mentally Fit Employee Assistance Program, subsidized and discounted Weight Watchers® program and other employee discount programs.

Pay

Base Pay Range: $110000 - $180000 USD. An individual's position in the range is determined by the specific role, the scope and responsibilities of the role, work experience, education, certification(s), training, and additional qualifications. We review internal pay, the competitive market, and business environment prior to extending an offer.

Schedule

Work Schedule: Ally designates roles as (1) fully on-site, (2) hybrid, or (3) fully remote. Hybrid roles are generally expected to be in the office a certain number of days per week as indicated by your manager. Your hiring manager will discuss this role's specific work requirements with you during the hiring process. All work requirements are subject to change at any time based on leader discretion and/or business need.