Security (Technology) Architect

Job Mission

As a security architect your mission is to secure our organisation by applying a hacker mindset into the design of systems while thinking of operational embedding through training, governance and processes. You drive the secure adoption of new technologies by creating security standards and patterns and advice about the best ways to implement security measures to meet business and maintain and apply your expertise to educate the organization teams. You drive the implementation of security tooling to strengthen our identification, prevention, detection and response capabilities.
 

Job Description

• Supporting projects and the risk managers in performing security risk assessments at design phase.
• Function as an approver during implementation phases of projects. Follow-up any potential findings by proposing risk reducing measures. Liaise with Enterprise Architecture and Organizational Architectural Boards to validate solutions.
• Provide clear guidelines for the use/scope of (partially) overlapping security solutions so they do not leave a gap or introduce ambiguity.
• Provide advice on how identified risks can be mitigated and practical guidance on how to achieve the best balance between risk and needs.
• Translate the relevant security policies, standards and best practices into practical guidance and help identify solutions.
• Develop and maintain security architecture artifacts (e.g., models, templates, standards and procedures) that can be used to leverage security capabilities in projects and operations.
• Contribute to innovation and developing a best-in-class security capabilities to improve ASML Security Posture.
• Draft security policies and standards to be reviewed and approved by executive management and/or formally authorized by the CISO.
• Conduct or facilitate threat modelling of services and applications that tie to the risk and data associated with the service or application.
• Review security technologies, tools and services, and make recommendations for improvements to the broader security team for their use, based on security, financial and operational metrics.
• Effectively collaborate with other (security) architects for quality assurance, information sharing, prioritizing and distributing the architecture workload.
• Document and effectively communicate design decisions in a central architecture repository.
• Build excellent working relationships with the project team members and all project stakeholders, including security risk officers and IT Operational staff.

Education
Master’s degree in computer science, information systems, information management, cybersecurity, or a related field. Any of the following certifications are a plus: CISSP, TOGAF, SANS’ GIAC, SABSA (SCF). Courses or certifications in SAFE Agile way of working are a plus as well.

Experience
For this role we are looking for someone with 3 – 7 years of work experience in working in IT security across several IT domains in a large organization. To perform the role successfully a solid understanding of an IT environment and its business needs is required, along with the security expertise to assess and mitigate the (domain specific) security risks with secure designs.
 

• Strong conceptual knowledge of, and experience in cyber security, and working in or for an international security operations team or cybersecurity incident response team
• Demonstrated ability to partake in Agile way of working and providing incremental system architecture (ISAs)
• Excellent understanding of security operations (SOC/CSIRT) and tooling to support its processes · Full-stack knowledge of IT infrastructure on all technology layers and ITIL processes
• Hands on experience with reviewing security architecture & is able to provide expert feedback
• Knowledge of Business Process Management (frameworks)
• Knowledge of Archimate (language) and tooling like ARIS
• Experience designing the deployment of applications and infrastructure into on premise and cloud services
• Experience in both the people & processes side of security as well as technology security capabilities
• You are familiar/have experience with the following regulations, standards and frameworks:
• NIST Cybersecurity Framework (CSF)
• IOT Security Compliance Framework
• ISO 31000
• General Data Protection Regulation (GDPR)