Principal Security Architect

Location: West Des Moines

Time Type: Full time

Job Description

Job Description:

We are looking to add a Principal Security Architect to join our Information Security team in West Des Moines, Iowa. Offering a forward-thinking, innovative, and vibrant company culture, along with the opportunity to share your unique potential, there really is no place like Holmes!

The Principal Security Architect is a senior technical leader responsible for designing and advancing enterprise security architecture across data protection, Microsoft security technologies, identity, cloud, and Security Operations. This role combines strategic architecture with hands-on technical leadership to reduce risk and implement scalable security solutions.

Essential Responsibilities:

• Define and maintain enterprise security architecture, standards, and security design patterns.
• Lead data security architecture using Varonis and Microsoft Purview, including data discovery, classification, sensitivity labeling, access governance, and DLP.
• Design and improve security monitoring, SOC/MDR, SIEM, detection, and incident response capabilities.
• Provide architectural leadership across Microsoft Entra ID, Defender XDR, Sentinel, Intune, and Microsoft 365 security.
• Support identity and Zero Trust initiatives, including RBAC, least privilege, Conditional Access, MFA, and privileged access.
• Design secure Azure, AWS, and hybrid environments, establishing guardrails for identity, network, application, and data protection.
• Partner with technology teams and third-party security providers to strengthen prevention, detection, and response capabilities.
• Develop roadmaps, and target-state architectures aligned with business objectives, emerging risks, and with NIST CSF, ISO 27001, CIS Controls, SOC 2, HIPAA, GLBA, and NYDFS requirements.
• Assess new technologies, applications, projects, and architectures to identify risks and recommend appropriate security controls.
• Conduct security architecture and technical design reviews for new/existing technologies and vendors, recommending solutions that reduce risk, improve security capabilities, and support operational efficiency.
• Attend team and enterprise meetings, as well as leadership training opportunities offered internally and externally.
• Support and maintain standardized processes to ensure efficient and effective quality service according to established quality guidelines.
• Provide backup assistance for team members, as necessary.
• Manage special projects and other duties as assigned.

Knowledge, Skills, and Abilities:

• Strong knowledge of enterprise security architecture principles, including security patterns, reference architectures, defense-in-depth, and Zero Trust.
• Strong understanding of security threats, vulnerabilities, attack techniques, and control frameworks, including MITRE ATT&CK, and the ability to incorporate them into secure architecture and design.
• Strong understanding of Security Operations architecture, including SOC/MDR, SIEM, security telemetry, threat detection, and incident response integration.
• Strong knowledge of identity and access architecture, including RBAC, least privilege, MFA, privileged access, identity governance, and Zero Trust principles.
• Strong knowledge of cloud and hybrid security architecture, including identity, network, application, workload, and data protection controls.
• Strong understanding of data security architecture, including data classification, encryption, DLP, access governance, and protection of sensitive information.
• Demonstrated ability to design, evaluate, and guide implementation of enterprise security architectures across cloud, identity, data, applications, infrastructure, and Security Operations.
• Knowledge of recognized security and compliance frameworks such as NIST CSF, CIS Controls, ISO 27001, SOC 2, HIPAA, and GLBA.
• Strong communication and collaboration skills with the ability to translate complex technical risks and architectural decisions into clear business recommendations.
• Ability to evaluate solution architectures, identify security gaps, and recommend practical controls and remediation strategies.
• Ability to translate technical security risks and architectural decisions into clear, business-focused recommendations for technical teams and leadership.
• Ability to establish security architecture standards, guardrails, and technical direction while influencing cross-functional teams without direct authority.
• Strong ability to collaborate with security, infrastructure, cloud, application, data, and business teams to embed security into technology designs and strategic initiatives.
• Ability to be available for work on a daily basis and extended hours as necessary.
• Ability and willingness to consistently participate in internal and external educational opportunities to enhance knowledge of current insurance topics or relevant system improvements.
• Ability and willingness to pursue relevant designations and/or continuing education, as appropriate.
• Ability to apply common sense understanding to carry out instructions furnished in written, oral or diagram form. Ability to deal with problems involving several concrete variables in standardized situations.
• Ability to exert up to 10 pounds of force occasionally, and/or negligible amount of force frequently or constantly to lift, carry, push, or pull objects.
• Must be knowledgeable of and comply with HMA's Client Privacy Policy, HIPAA regulations and E&O procedures and policies.

 Qualifications:

• Education: Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field, or equivalent combination of education and relevant professional experience.
• Experience: 6–8+ years of progressive cybersecurity experience, with demonstrated experience in security architecture, security engineering, or technical design. Senior security architecture or technical leadership experience preferred. CISSP, CCSP, Microsoft security certifications, or comparable security and cloud certifications preferred.
  • Strong experience with Varonis and Microsoft Purview, including data discovery, classification, access governance, information protection, and Data Loss Prevention (DLP).
  • Strong experience with the Microsoft security ecosystem, including Entra ID, Defender XDR, Sentinel, and Microsoft 365 security capabilities.
  • Experience designing identity and access security, including RBAC, least privilege, MFA, privileged access, Conditional Access, and Zero Trust principles.
  • Working knowledge of Security Operations architecture, including SIEM, SOC/MDR, security telemetry, threat detection, incident response, and security tool integrations.
  • Experience conducting security architecture and design reviews, identifying security gaps, and recommending practical, risk-based controls.

Technical Competencies

• Business & Technology Knowledge: Invests in the development of technical knowledge, understands business needs to make informed decisions and deliver technology solutions, including effective related processes and procedures.
• Problem Solving: Ability to efficiently identify problem(s), leverage resources to determine root cause(s) and propose and implement solutions or make improvements.

Here’s a little bit about us:

In addition to being great at what you do, we place a high emphasis on building a best-in-class culture. We do this through empowering employees to build trust through honest and caring actions, ensuring clear and constructive communication, establishing meaningful client relationships that support their unique potential, and contributing to the organization's success by effectively influencing and uplifting team members. 

Benefits: In addition to core benefits like health, dental and vision, also enjoy benefits such as:

· Paid Parental Leave and supportive New Parent Benefits — We know being a working parent is hard, and we want to support our employees in this journey!

· Company paid continuing Education & Tuition Reimbursement — We support those who want to develop and grow.

· 401k Profit Sharing — Each year, Holmes Murphy makes a lump sum contribution to every full-time employee’s 401k. This means, even if you’re not in a position to set money aside for the future at any point in time, Holmes Murphy will do it on your behalf! We are forward-thinking and want to be sure your future is cared for.

· Generous time off practices in addition to paid holidays — Yes, we actually encourage employees to use their time off, and they do. After all, you can’t be at your best for our clients if you’re not at your best for yourself first.

· Supportive of community efforts with paid Volunteer time off and employee matching gifts to charities that are important to you — Through our Holmes Murphy Foundation, we offer several vehicles where you can make an impact and care for those around you.

• Inclusion & Belonging Programs — Holmes Murphy is committed to celebrating every employee’s unique potential. Through inclusion and belonging initiatives, titled Uniquely United, not only do we offer employees a paid Diversity Day time-off option, but we also have a Uniquely United Committee, Employee Resource Groups, and development programs to advance our culture of belonging. We encourage employees to engage in ways that are meaningful to them to enhance their overall experience! 
• Consistent merit increase and promotion opportunities — Employees are reviewed annually for merit increases and promotion opportunities because we believe growth is important — not only with your financial wellbeing, but also your career wellbeing.
• Discretionary bonus opportunity — Yes, there is an annual opportunity to make more money. Who doesn’t love that?!

At this time, we are not considering candidates who require any type of immigration sponsorship now or in the future. This includes candidates whose current work authorization is temporary or set to expire and who would require employer participation in any renewal, extension, or new authorization process to continue employment.

Holmes Murphy & Associates is an Equal Opportunity Employer.