Security Architect

Position Overview

The Security Architect is a senior technical practitioner responsible for designing the security architecture of Hexion’s enterprise environment: on-premises infrastructure, Azure and AWS cloud platforms, AI and machine learning systems, and the interfaces between enterprise IT, Operational Technology, and physical security systems.

This role owns reference architectures, security design patterns, and architectural standards — and holds the authority to review, challenge, and approve designs before they are built. This is an architecture role, not a compliance role.

Job Responsibilities

• Enterprise & On-Premises Architecture

  • Own The Security Architecture Of Hexion’s On-premises Estate

    • Design and maintain reference architectures for network segmentation, zero trust access, remote access, and data center security
    • Define security architecture standards for endpoints, servers, virtualization, backup, and disaster recovery
    • Lead the architectural review function — evaluate new systems, integrations, and infrastructure changes against defined standards and document exceptions with compensating controls
    • Design detection and logging architecture in partnership with security operations, ensuring telemetry coverage across on-premises and cloud estates
    • Maintain the enterprise security architecture roadmap, sequencing capability investments against risk reduction

• Cloud Security Architecture (Azure and AWS)

  • Serve As The Design Authority For Multi-cloud Security
  • Architect landing zones, subscription and account structures, network topology, and guardrails for both Azure and AWS
  • Design cloud identity architecture — workload identity, federation, conditional access, least-privilege IAM policy models, and secrets management
  • Apply ISO/IEC 27017 cloud security controls to define Hexion’s architectural obligations as a cloud service customer, and where applicable as a cloud service provider
  • Define encryption and key management architecture across Azure Key Vault, AWS KMS, and on-premises HSM or key stores
  • Establish policy-as-code and infrastructure-as-code security patterns, embedding controls into Terraform, Bicep, or CloudFormation pipelines
  • Design secure connectivity between cloud platforms, on-premises data centers, and plant networks

  • AI Security Architecture (ISO/IEC 42001)

    • Design the security architecture for Hexion’s adoption of artificial intelligence
    • Define reference architectures for enterprise AI use — hosted LLM services, retrieval-augmented generation, agentic workflows, and AI-enabled SaaS
    • Apply ISO/IEC 42001 as the governance framework for AI management, translating its requirements into architectural controls rather than paperwork
    • Design controls against recognized AI threat models — prompt injection, training and inference data poisoning, model and data exfiltration, insecure output handling, and excessive agency (OWASP Top 10 for LLM Applications, MITRE ATLAS, NIST AI RMF)
    • Define data protection boundaries for AI systems: what data may reach which model, under what tenancy, with what retention and residency guarantees
    • Establish identity, authorization, and audit architecture for AI agents and non-human identities acting on enterprise systems
    • Advises on secure use of AI within OT and engineering contexts, where model outputs may influence physical processes

    • OT & Process Control Security Architecture

      • Partner with engineering and plant operations to secure industrial environments
      • Design IT/OT boundary architecture — segmentation, DMZ patterns, unidirectional gateways where warranted, and secure remote access for vendors and engineers
      • Apply ISO/IEC 27019 and IEC 62443 concepts to zone and conduit design, asset inventory, and control selection for process control systems
      • Define architectural standards for OT monitoring, passive asset discovery, and safe patching and change practices
      • Support architecture for plant modernization, connected sensor, and industrial IoT initiatives without compromising safety or availability
      • Translate enterprise security standards into requirements that are implementable on the plant floor, respecting availability and safety constraints

      • Physical Security Architecture

        • Treat Physical And Logical Security As One Architecture
        • Architect the convergence of physical security platforms with enterprise identity — provisioning, deprovisioning, and access review across badge and logical systems
        • Address the network and lifecycle security of physical security devices, which frequently share infrastructure with OT and enterprise networks
        • Define physical security requirements for data centers, control rooms, network closets, and cloud colocation or interconnect facilities
        • Support site risk assessments and design layered protection appropriate to facility criticality

        • Standards, Patterns & Technical Governance

          • Maintain The Architectural Artifacts The Organization Builds Against
          • Author and maintain security standards, design patterns, and hardening baselines mapped to ISO/IEC 27001 Annex A and the extension standards named above
          • Conduct threat modeling and architectural risk assessments for major programs and high-impact changes
          • Contribute security architecture requirements to vendor selection, third-party integrations, and M&A technical due diligence
          • Mentor engineers and analysts, raising the architectural fluency of the broader security and IT organization

        Qualifications

        • Bachelor’s degree in Computer Science, Information Security, Engineering, or related field (or equivalent practical experience)
        • 8+ years in information security with at least 4 years in a dedicated security architecture or senior security engineering role
        • Demonstrated experience architecting security for both on-premises infrastructure and public cloud at enterprise scale
        • Hands-on architectural depth in both Microsoft Azure and Amazon Web Services — identity, networking, encryption, and native security services in each
        • Familiarity with ISO/IEC 27001 and Annex A controls as an architectural framework, including practical application of ISO/IEC 27017 and 27018 to cloud designs
        • Familiarity with ISO/IEC 42001 and the AI security threat landscape, with experience designing controls for AI or machine learning systems
        • Understanding of OT and industrial control system architecture, including ISO/IEC 27019, IEC 62443, or NIST SP 800-82 concepts
        • Experience with physical security systems and the integration of physical and logical access control
        • Strong identity architecture skills — Active Directory, Entra ID, SAML and OIDC federation, privileged access management, and non-human identity models
        • Network security design depth — segmentation, zero trust architecture, firewalls, proxies, and secure connectivity across hybrid environments
        • Proficiency with threat modeling methodologies (STRIDE, PASTA, attack trees) and the ability to produce clear architectural documentation and diagrams
        • Strong written and verbal communication — able to defend a design to engineers and explain the same decision to executives