What success looks like in this role:
- Define an end-to-end, layered (Defense-in-depth) cybersecurity architecture across cloud, SIEM/SOC, MDR, CTEM,CRV,SNA, IAM, network, endpoint, and data domains
- Establish reference architectures, design patterns, and reusable security blueprints that delivery teams can adopt rather than rebuild
- Map capabilities to business risk, maintain a forward-looking architecture roadmap, and rationalize tooling to reduce complexity and tool sprawl
- Establish enterprise threat modeling practices (e.g. STRIDE, attack trees, MITRE ATT&CK) and embed them early in the design lifecycle (security-by-design)
- Identify trust boundaries, attack paths, and data flows; translate identified threats into prioritized, actionable controls
- Extend threat modeling to AI/LLM and automation systems, addressing risks such as prompt injection, model abuse, and data poisoning
- Define and drive the Zero Trust strategy and roadmap across identity, devices, network, applications, and data
- Apply least-privilege access, micro-segmentation, strong authentication/MFA, conditional access, and continuous verification
- Treat identity as the primary control plane, aligning Zero Trust closely with IAM and Secure Network Access
- Architect IAM using Microsoft Entra - authentication and authorization, RBAC/ABAC, conditional access, and the identity lifecycle (joiner / mover / leaver)
- Design privileged access management (PAM/PIM), access governance and reviews, and protection of workload and non-human identities
- Ensure IAM underpins Zero Trust as the enterprise’s primary security perimeter
- Architect a proactive, predictive, and increasingly autonomous Security Operations Center (SOC), including a defined detection engineering lifecycle (detection-as-code, ATT&CK coverage mapping, tuning to reduce false positives) and threat hunting
- Integrate Managed Detection and Response (MDR) - align 24/7 detection and response, define the shared-responsibility model, and connect MDR telemetry and response actions into the internal SIEM/SOAR
- Drive measurable improvements in mean time to detect and respond (MTTD/MTTR)
- Establish a CTEM program across the five stages - scoping, discovery, prioritization, validation, and mobilization
- Prioritize exposures by real exploitability and business impact (beyond raw CVE counts), incorporating breach-and-attack simulation and attack-path analysis
- Drive continuous, evidence-based exposure reduction and remediation
- Architect Secure Network Access using Zero Trust Network Access (ZTNA) and SASE/SSE principles, replacing legacy flat-network and VPN models
- Design network segmentation / micro-segmentation and east-west visibility, integrating Network Detection and Response (NDR)
- Secure hybrid, remote, and third-party access for users and workloads
- Design cyber resilience and recovery architecture, including an isolated, immutable Cyber Recovery Vault (air-gapped) and clean-room recovery capability
- Architect recovery from ransomware and destructive attacks, integrate with backup/DR, and define recovery objectives (RPO/RTO) and data-integrity validation
- Establish regular recovery testing and align the design with operational resilience requirements
- Design AI-driven detection and response; implement Security Copilot and agentic systems for automated triage, investigation, and analyst augmentation, progressing toward an autonomous SOC
- Apply Generative AI responsibly - establish governance and guardrails for GenAI risks (prompt injection, data leakage, hallucination, model and data security), with human-in-the-loop for high-impact actions
- Enable adaptive and self-healing security systems
- Drive an automation-first approach - SOAR playbooks, agentic and AI-enabled automation, and self-healing workflows, targeting 30–50% automation enablement
- Architect platforms using Microsoft Sentinel, Defender, Entra, and Purview; build reusable modules for detection, response, and automation
- Apply engineering practices including infrastructure-as-code, detection-as-code, version control, and testing
- Partner with Solutions Development to lead PoCs and emerging-technology adoption; translate new technology into scalable solutions
- Work with Delivery to understand real-world issues, ideate, and create reusable assets
- Align architecture with ISO 27001 and NIST (CSF / 800-53) standards, and embed security-by-design and compliance-as-code
- Support audits and evidence collection; balance compliance requirements with risk-based exposure reduction
- Work closely with delivery, engineering, and business teams
- Act as a trusted technical advisor across the organization
You will be successful in this role if you have:
- Bachelor’s or Master’s degree in a relevant field
- 12–18 years of cybersecurity experience, including hands-on architecture and engineering
- Deep expertise in the Microsoft Security stack (Sentinel, Defender, Entra, Purview) and cloud security
- Demonstrated experience across Zero Trust, IAM, MDR/SOC, CTEM, Secure Network Access (ZTNA/SASE), and cyber resilience and recovery
- Strong threat Modeling and threat-informed Defense experience
- Strong AI/ML cybersecurity exposure, including GenAI / agentic security and AI risk governance
- Proven hands-on capability - detection engineering, automation, scripting, and building PoCs
Unisys is proud to be an equal opportunity employer that considers all qualified applicants without regard to age, blood type, caste, citizenship, color, disability, family medical history, family status, ethnicity, gender, gender expression, gender identity, genetic information, marital status, national origin, parental status, pregnancy, race, religion, sex, sexual orientation, transgender status, veteran status or any other category protected by law.
Local employment practices and rights may vary by jurisdiction and are subject to applicable local laws. This commitment includes our efforts to provide for all those who seek to express interest in employment the opportunity to participate without barriers.
If you are a US job seeker unable to review the job opportunities herein, or cannot otherwise complete your expression of interest, without additional assistance and would like to discuss a request for reasonable accommodation, please contact our Global Recruiting organization at [email protected] . US job seekers can find more information about Unisys’ EEO commitment here .
