Cyber Security Architect

Job Description:

Looking for a rewarding career? Johnson Brothers is a leading family-owned distributor of wine, spirits, and beer, delivering exceptional service since 1953. We proudly represent the world’s top beverage brands and are committed to excellence, innovation, and growth. Johnson Brothers offers exciting opportunities in a variety of areas. Join our passionate team and help shape the future of the beverage industry!

The Architect – Cyber Security directs strategy, implementation and ongoing effectiveness of the organization's security infrastructure, ensuring the protection of systems and data through security controls, policies, standards and procedures.  This role ensures that the stakeholder security requirements necessary to protect the organization's mission and business processes are adequately addressed in all aspects of enterprise architecture including reference models, solution architectures, and the resulting systems supporting those missions and business processes.  This role also maintains a third-party risk management program, further managing information security risk reducing third party risk and further protecting the organization’s enterprise information assets.  The scope of responsibility will encompass all applications and infrastructure, on-premise and cloud delivered, including the technical implementation, governance, policies and procedures which apply to the information security architecture program. 

This role is a hybrid position requiring the candidate to be on site at our St. Paul location 3x a week.

Job Responsibilities:

• Direct and approve the design of security systems and solutions, across the entire IT portfolio of assets, systems and projects. This includes documenting and addressing organization's information security, cybersecurity architecture, and systems security engineering requirements throughout the acquisition life cycle.

• Engage with project teams to ensure security is embedded in solution design and implementation for all IT projects.

• Employ secure configuration management processes.

• Ensure that acquired or developed system(s) and architecture(s) are consistent with organization's cybersecurity architecture guidelines.

• Identify and prioritize critical business functions in collaboration with organizational stakeholders.

• Perform security reviews, identify gaps in security architecture, and develop a security risk management plan.

• Define and document how the implementation of a new system or new interfaces between systems impacts the security posture of the current environment.

• Evaluate security architectures and designs to determine the adequacy of security design and architecture proposed or provided in response to requirements contained in system and third-party vendor documents.

• Determine the protection needs (i.e., security controls) for the information system(s) and network(s) and document appropriately.

• Collaborate with the IT Architecture team to promote architecture processes and practices across the organization.

• Maintain a Third-Party Risk Management program, including at a minimum, annual reviews of all third-party technology vendors.

• Create, socialize and secure executive sponsorship for security policies and controls.

• Make sure that cyber security policies and procedures are communicated to all personnel and that compliance is enforced.

• Participate in governance activities to oversee the Security Program and engage executive team as appropriate.

• Maintain a current understanding the IT threat landscape and apply that understanding to constantly improve our security program and reduce risk.

• Collaborate with IT asset inventory owners and security architectures needed to ensure the full understanding and ability to secure our environment and reduce risk.

• Schedule and execute periodic security audits to confirm the security program is preforming as expected.

• Constantly update the cyber security strategy to leverage new technology and threat information.

• Communicate best practices and risks to all parts of the business. 
   

Skills Required:

• Direct experience with information security architecture process, practices, frameworks and governance, supporting medium to large enterprises.

• Strategic thinking to identify risks and trends to stay ahead of threats and protect the company.

• Understand multiple complex systems and technology at a detail level in a constantly changing threat environment.

• Deep base of technical understanding and practical experience for networking, servers, data centers, workstations, software, all aspects needed to run technology for a nationwide wholesale distributor.

• Technical knowledge of different types of hardware, storage, imaging and file system analysis to discover risks and threats.

• Network security including firewalls, VPN, SD-WAN, TCP/IP, communication protocols and vulnerabilities.

• Hands on experience with enterprise and personal operating systems, such as Windows, Linux and MacOS.

• Experience with Mobile operating systems, applications and security protocols.

• Protection systems against malware, hacking and other threats, including Anti-Virus, SEG, SIEM, NDR, EDR, NAC, IDS, IPS, threat hunting, and other protection systems.

• Application security including Secure Coding Standards and Static Code Analysis as appropriate.

• Third party security risk assessments and evaluations in support of business and technology goals and the information security strategy and program.

• Regulatory compliance knowledge, including HIPAA, SOX, PCI, NIST and GLBA.

• Understanding of Federal, State and Local laws concerning data acquisition, protection and transmission.

• Grasp the issue or problem, identify a resolution plan and execute quickly.

• Strong leadership presence, relationship management and people leadership.

• Excellent communication, documentation and collaboration skills to speed acceptance and support for recommendations and plans.

• A flexible, organized work style is necessary to balance the need for comprehensive, detailed analysis against the instances where you must respond quickly to crises which arrive without warning.
   

Job Requirements:

• 10+ years hands on technology experience in a relevant organization

• 5+ years direct experience in Cyber Security Architecture

• Direct experience working with and presenting to Executive Leadership, Board Members, and/or IT Leadership.

• IT Management/Leadership experience is a plus

• Bachelor’s Degree in Information Security, Computer Science or a related field (required)

• Master’s degree in Information Security (preferred)

• Specialized training and certifications related to Information Security (preferred):

  • Certified Information Systems Security Professional

  • Certified Information Systems Auditor 

  • Certified Information Security Manager

  • Certified in the Governance of Enterprise IT 

  • Certified in Risk and Information Systems Control 

  • Information Systems Security Management
     

The expected pay range for this role is a base pay of $96,594.00

- $150,000 annually . It is not typical for an individual to be hired at or near the top of the range for their role. Actual placement within range will be contingent upon several factors, including but not limited to the candidate's qualifications, education, experience, internal equity, union status (where applicable) and alignment with market data. Johnson Brothers offers eligible team members and their dependents comprehensive health benefits and programs, which include medical, dental, vision, life insurance, health savings and flexible spending accounts. Other benefits for eligible team members include 401(k) with an employer match, short term disability coverage, company-paid long term disability insurance, generous paid time off (PTO) plans and paid parental leave.
 

Johnson Brothers is an equal opportunity employer, committed to fair treatment and hiring based on qualifications. We prohibit discrimination based on race, color, religion, gender identity, sexual orientation, age, disability, military status, or any other protected status under applicable laws.
 

Worker Sub-Type:

Time Type: