Software Architect

The BEST Program Security Architect will work with the BEST Security Lead, BEST Compliance Lead, BEST Technical Lead, Executive Office of Technology Services and Security (EOTSS) security team, and product vendors. The primary responsibility is to implement business and technical controls that meet specific security requirements and to define processes and standards that maintain approved security configurations in the new Financial Solution. This role ensures confidentiality, integrity, availability, risk management, and compliance of the business solution. As a key member of the project’s Security Team, the Security Architect will work closely with other team members to develop and implement a comprehensive information security program.

Responsibilities

Implement business and technical controls that meet specific security requirements and define processes and standards that maintain approved security configurations in the new Financial Solution; Ensure confidentiality, integrity, availability, risk management, and compliance of the business solution; Design and recommend protocols and procedures for monitoring the product vendor’s performance against Service Level Agreement standards regarding data security, annual security audits, and disaster recovery testing; Define security policies, processes and standards related to end-user roles, data access for application users, and how users will be provisioned and de-provisioned; Provide input on selection, deployment, and oversight of security technologies; Participate in developing, testing, and documenting security procedures, including disaster recovery, business continuity, backups, and incident response; Monitor and assess business continuity and disaster recovery programs, network penetration, and other tests to assess application vulnerability; Participate in risk and compliance assessment reviews of the new Financial solution and supporting services and infrastructure; Work with Executive OTSS to onboard Advantage 4 to work with the Commonwealth Single Sign On (SSO) for employees and vendors; Remediate department user access for users not on mass.gov; Oversee security SLAs and security testing (pen-testing), and review/remediate results; Oversee execution testing of SIEM across Cloud SaaS vendor, Comptroller’s office, and EOTSS; Oversee integration testing of EOTSS SSO, IAM, MFA, Cloud SaaS vendor user access management, and Comptroller’s access controls and provisioning processes; Document and implement technical controls, processes and procedures related to data security; Assist in identifying security requirements using risk and business impact assessments; Assess compliance with risk and cybersecurity frameworks such as NIST, ISO, COSO, PCI, FERPA, and GLBA; Provide advisory role in application development and implementation to assess security requirements and controls; Support go-live security solution testing and end-user provisioning; Research, evaluate and recommend information-security-related hardware and software; Provide advice and third-level support to security operations and IT for incident response

Requirements

In-depth exposure to technical configurations, technologies, and processing environments in one or more projects of similar size and complexity to BEST; In-depth knowledge and understanding of information risk concepts and principles as a means of relating business needs to security controls; Knowledge of and experience in developing and documenting security architecture and plans, including strategic, tactical and project plans; Documented experience with common information security management frameworks, such as International Organization for Standardization (ISO) 2700x and the ITIL, SOX, COBIT and National Institute of Standards and Technology (NIST) frameworks; Experience in architecting and implementing cloud-based security solutions; Strong knowledge of security tools and capabilities, such as IDM and SSO; Extensive experience in integrating security tools and 3rd party vendor solutions; Exceptional planning, organization, communication, prioritization, and business analysis skills; In-depth knowledge of risk assessment methods and technologies; Proficiency in performing risk, business impact, control, and vulnerability assessments; Excellent technical knowledge of mainstream operating systems and a wide range of security technologies, such as network security appliances, identity, and access management (IAM) systems, anti-malware solutions, privilege access management (PAM), data loss prevention (DLP), encryption at-rest and in-transit, multi-factor; Experience with Software as a Service cloud implementations particularly those in which legacy on premise applications have been migrated to cloud delivery options; Security solution design and development leveraging multiple security teams with disparate roles and responsibilities using a cloud SaaS solution; Experience in migrating security solutions from legacy on-premises environment into a cloud solution within a highly regulated environment; Experience in performing / supporting security audits and compliance validation; Documented ability to interact with personnel at all levels and across all business units and organizations, and to comprehend business imperatives; Bachelor's degree in computer science, system analysis or a related study, or equivalent experience; Minimum of five years of design and implementation experience in IT, with a deep knowledge in a minimum of two of the following technical disciplines: infrastructure and network design, application development, application programming interfaces (APIs), middleware, servers and storage, database management, data security, and system administration and operations; Experience in generation of Security materials, including but not limited to compliance adherence, security operational procedures, security implementation plans, and network and security diagrams; Minimum of three years of security architecting design and implementation with security certifications, such as: SIA Security +