Security Architect II

Are you looking to make an impactful difference in your work, yourself, and your community? Why settle for just a job when you can land a career? At ICW Group, we are hiring team members who are ready to use their skills, curiosity, and drive to be part of our journey as we strive to transform the insurance carrier space. We're proud to be in business for over 50 years, and its change agents like yourself that will help us continue to deliver our mission to create the best insurance experience possible.

Headquartered in San Diego with regional offices located throughout the United States, ICW Group has been named for the twelfth consecutive year in a row and for the 20th time overall as a Top 50 performing P&C organization offering the stability of a large, profitable and growing company combined with a focus on all things people. It's our team members who make us an employer of choice and the vibrant company we are today. We strive to make both our internal and external communities better everyday! Learn more about why you want to be here!

PURPOSE OF THE JOB

The Security Architect II is a senior individual contributor within the Enterprise Architecture team who develops and influences enterprise security architecture direction and establishes frameworks and reusable guidance within assigned areas of responsibility to support the operationalization of security across the enterprise. The role translates business objectives, risk priorities, and regulatory obligations into practical security capabilities, standards, reference architectures, and implementation patterns. Working across business, technology, security, infrastructure, data, and delivery teams, the Security Architect II promotes consistent risk-based decisions and ensures security is designed into enterprise platforms, cloud environments, applications, integrations, data solutions, and emerging AI capabilities.

ESSENTIAL DUTIES AND RESPONSIBILITIES

Develops and influences enterprise security architecture and strategic direction.

· Develops, maintains, and communicates enterprise security architecture frameworks, principles, target-state architectures, reference architectures, roadmaps, and reusable security patterns.

· Maps business goals, risk appetite, regulatory obligations, and enterprise strategy to security capabilities and technical implementation direction.

· Partners with enterprise, solution, cloud, data, integration, infrastructure, and AI architects to embed security into technology strategies and solution designs.

· Defines current-state and target-state security capabilities, identifies gaps and dependencies, and recommends sequenced initiatives to improve enterprise security maturity.

· Provides architecture guidance for identity and access management, zero trust, network and cloud security, application security, data protection, cryptography, secrets management, logging and monitoring, resilience, vulnerability management, and third-party technology risk.

· Creates decision records and clearly documents security trade-offs, assumptions, risks, compensating controls, and required follow-up actions.

Defines and maintains security standards, guidelines, and procedures.

· Develops and maintains enterprise security standards, guidelines, control patterns, and procedures within assigned areas of responsibility and contributes to broader enterprise security direction, ensuring the resulting guidance is actionable, internally consistent, and aligned with enterprise policy.

· Uses recognized frameworks and principles such as NIST Cybersecurity Framework, NIST SP 800-53, NIST Zero Trust Architecture, ISO/IEC 27001 and 27002, CIS Controls, and secure-by-design practices as appropriate to the organization.

· Develops and maintains minimum security requirements and approved patterns within assigned areas of responsibility for AWS services, cloud accounts, networking, identity, encryption, key management, secrets, workload protection, observability, and incident readiness.

· Contributes to exception and risk-acceptance criteria and partners with Security, Risk, Compliance, and technology owners to ensure deviations are explicit, time-bound, and appropriately approved.

· Maintains traceability among business objectives, security risks, policies, standards, architecture decisions, technical controls, and implementation evidence.

Provides security architecture governance and solution guidance.

· Performs and documents security architecture reviews for strategic initiatives, platforms, products, vendor solutions, integrations, and material technology changes.

· Presents security-significant decisions and recommendations to the Architecture Review Board and other governance forums.

· Engages early in initiative planning and solution design to identify threats, misuse cases, trust boundaries, attack paths, security requirements, and control responsibilities.

· Advises teams on secure architecture patterns without displacing accountable engineering, cybersecurity operations, risk, privacy, legal, or business owners.

· Evaluates vendor products and services, including security capabilities, architectural fit, data handling, integration requirements, operational dependencies, and concentration risk.

· Mentors architects and technical teams, builds security architecture competency, and serves as a trusted advisor on complex or high-impact decisions.

Advances AI security architecture.

· Defines security architecture guidance for AI and generative AI solutions, including data protection, identity and authorization, model and supply-chain risk, prompt injection, tool misuse, and unintended data disclosure.

· Develops risk-based security patterns for AI applications and agentic workflows within assigned areas of responsibility, including adversarial testing, monitoring, human oversight, and controls that constrain autonomous actions.

· Collaborates with data, privacy, legal, risk, and AI governance stakeholders to align AI security controls with the NIST AI Risk Management Framework, the NIST Generative AI Profile, OWASP guidance, business impact, and acceptable risk.

SUPERVISORY RESPONSIBILITIES

This role does not have direct supervisory responsibilities. The role provides technical leadership, architecture mentorship, and influence across teams and initiatives.

EDUCATION AND EXPERIENCE

· Bachelor's degree from a four-year college or university in Cybersecurity, Computer Science, Information Systems, Engineering, or a related field required. Equivalent relevant experience may be considered in lieu of a degree.

· Minimum 8 years of progressively responsible IT or cybersecurity experience required.

· Minimum 4 years of experience in security architecture, cloud security architecture, enterprise architecture, or solution architecture with substantial security responsibility required.

· Demonstrated experience defining security standards, reference architectures, technical controls, and architecture roadmaps in a complex enterprise environment required.

· Hands-on or architecture-level experience with AWS security services, identity and access management, network security, application security, data protection, security monitoring, and secure cloud adoption required.

· Experience supporting regulated industries, financial services, or property and casualty insurance is preferred.

· Experience with AI, machine learning, generative AI, or agentic-system security and governance is preferred.

CERTIFICATES, LICENSES, AND REGISTRATIONS

One senior-level security or security architecture certification is required. CISSP is preferred as the baseline credential. Relevant alternatives or advanced credentials may include:

· ISC2 Certified Information Systems Security Professional (CISSP), Information Systems Security Architecture Professional (ISSAP), or Certified Cloud Security Professional (CCSP).

· AWS Certified Security - Specialty or AWS Certified Solutions Architect -