Security Architect
- Compensation
- Not disclosed
- Location
- Not listed
- Work setup
- Remote
- Seniority
- Not specified
- Employment
- Not specified
- Experience
- 4+ years
- Category
- Security
- Posted
Skills
Must have
- Bachelor’s degree in Computer Science, Information Security, Engineering, or related field (or equivalent practical experience)
- 8+ years in information security with at least 4 years in a dedicated security architecture or senior security engineering role
- Demonstrated experience architecting security for both on-premises infrastructure and public cloud at enterprise scale
- Hands-on architectural depth in both Microsoft Azure and Amazon Web Services — identity, networking, encryption, and native security services in each
- Working fluency with ISO/IEC 27001 and Annex A controls as an architectural framework, including practical application of ISO/IEC 27017 and 27018 to cloud designs
- Familiarity with ISO/IEC 42001 and the AI security threat landscape, with experience designing controls for AI or machine learning systems
- Understanding of OT and industrial control system architecture, including ISO/IEC 27019, IEC 62443, or NIST SP 800-82 concepts
- Experience with physical security systems and the integration of physical and logical access control
- Strong identity architecture skills — Active Directory, Entra ID, SAML and OIDC federation, privileged access management, and non-human identity models
- Network security design depth — segmentation, zero trust architecture, firewalls, proxies, and secure connectivity across hybrid environments
- Proficiency with threat modeling methodologies (STRIDE, PASTA, attack trees) and the ability to produce clear architectural documentation and diagrams
Nice to have
- Experience with:
- Manufacturing, chemical, energy, or other process industry environments
- Infrastructure-as-code and policy-as-code (Terraform, Bicep, CloudFormation, OPA, Sentinel)
- Secure software development lifecycle, application security, and CI/CD pipeline security
- Data security architecture — classification, DLP, tokenization, and data governance platforms
- Third-party and supply chain risk architecture, including SBOM and vendor integration patterns
- Global operations across multiple regulatory jurisdictions (GDPR, CCPA, NIS2, or similar)
- Certifications (any of the following valued):
- CISSP or CISSP-ISSAP (Information Systems Security Architecture Professional)
- SABSA, TOGAF, or equivalent architecture credential
- Azure Solutions Architect Expert or Azure Security Engineer Associate
- AWS Solutions Architect Professional or AWS Certified Security – Specialty
- GICSP, ISA/IEC 62443 Cybersecurity Specialist, or equivalent OT credential
- ISO/IEC 27001 Lead Implementer or ISO/IEC 42001 Lead Implementer
- CCSP, PSP (Physical Security Professional), or AI security credentials
Full description
Company Overview
Hexion is a global leader in specialty chemicals, delivering innovative solutions that improve performance, sustainability, and efficiency across industries. Our manufacturing operations span multiple continents, integrating complex Operational Technology (OT) environments with enterprise IT systems and a growing footprint in Microsoft Azure and Amazon Web Services. As the business adopts cloud platforms and artificial intelligence at scale, Hexion is investing in a security architecture function capable of designing defensible systems across every environment we operate — on-premises data centers, public cloud, the plant floor, and the physical perimeter that protects both.
Position Overview
The Security Architect is a senior technical practitioner responsible for designing the security architecture of Hexion’s enterprise environment: on-premises infrastructure, Azure and AWS cloud platforms, AI and machine learning systems, and the interfaces between enterprise IT, Operational Technology, and physical security systems. This role owns reference architectures, security design patterns, and architectural standards — and holds the authority to review, challenge, and approve designs before they are built.
This is an architecture role, not a compliance role. The successful candidate uses ISO/IEC 27001, 27017, 27018, 42001, and 27019 as the frameworks that shape control selection and design rationale, then works alongside engineering teams to make those controls real in configuration, code, and network design.
This role ensures:
- Security is designed into systems at inception rather than assessed after deployment
- On-premises, Azure, and AWS environments share a coherent identity, network, and data protection architecture
- Cloud services are architected against ISO/IEC 27017 and 27018 expectations for cloud security and PII protection
- AI and machine learning systems are designed with governance and technical controls aligned to ISO/IEC 42001 and recognized AI threat models
- OT and process control architectures are secured in partnership with engineering, informed by ISO/IEC 27019 and IEC 62443
- Physical security systems and controls are treated as part of the security architecture, not a separate discipline
- Architectural decisions are documented, defensible, and traceable to risk
Job Responsibilities
- Enterprise & On-Premises Architecture
Own the security architecture of Hexion’s on-premises estate:
- Design and maintain reference architectures for network segmentation, zero trust access, remote access, and data center security