Global Cybersecurity Senior Manager - Architecture

As the Infrastructure Security Architect – Secure Network, you will serve as the dedicated security architecture partner for BCG’s Secure Network Engineering Squad, defining the security strategy, architecture, and governance that protect the firm’s global network infrastructure spanning Security Service Edge, segmentation, DNS, and cloud network environments. You will establish the security requirements, architectural standards, and design guardrails that enable secure, scalable, and resilient network platforms while advancing BCG’s Zero Trust strategy and enterprise security objectives. As part of the Infrastructure Security Architecture team within Information Security Risk Management (ISRM), you will operate through a shared accountability model with Platform Engineering. You will provide architectural direction, governance, and design oversight throughout the solution lifecycle, while engineering teams retain ownership for implementation, delivery, and operational management. Success in this role requires strong technical leadership, sound architectural judgment, and the ability to influence global stakeholders across a matrixed organization. Define and maintain network security architecture for the enterprise: Security Service Edge (SSE), Zero Trust Network Access (ZTNA), secure web gateway, and CASB patterns. Define network segmentation and zoning strategy across offices, data centers, and cloud environments to constrain lateral movement, consistent with NIST SP 800-207 zero trust principles. Define DNS and web-layer security architecture requirements, including protective DNS, domain governance interfaces, and egress control. Own security architecture requirements for cloud network infrastructure: VPC/VNet design patterns, firewall zoning, next-generation firewall and cloud gateway placement, and secure interconnects. Define secure remote access architecture (ZTNA/VPN) and the deprecation path for legacy perimeter access patterns. Author and maintain the security standards, reference architectures, and control requirements that govern the Secure Network domain, mapped to CSF-09 (Security Architecture – Network & Cloud/Systems Security) and ZTMM maturity targets. Conduct security architecture reviews for secure network initiatives; issue dispositions, conditions, and architectural decision records traceable to ISRM governance. Contribute domain expertise to ZTMM maturity assessments, control gap analyses, and the security architecture roadmap. Serve as the dedicated architecture counterpart to the Secure Network Engineering Squad, validating feasibility and effectiveness of security controls through implementation without assuming delivery ownership. Define network segmentation and zoning strategy across offices, data centers, and cloud environments, underpinned by authoritative network asset inventory and topology mapping . Define logging, telemetry, and monitoring requirements (CSF-12) for secure network services in partnership with Security Operations, which owns SIEM, detection engineering, and continuous monitoring. Drive automation and policy-as-code adoption for network security controls, partnering with engineering to move enforcement and drift detection from manual review toward continuous, automated validation. Bachelor’s degree in a relevant field or equivalent practical experience. 6–10 years in security architecture, security engineering, or infrastructure security with demonstrated architecture responsibility. Experience operating in large, audit-sensitive, or regulated enterprise environments with formal governance and exception processes. Strong understanding of zero trust architecture (NIST SP 800-207, CISA ZTMM), enterprise control frameworks, and hybrid cloud environments (Azure, AWS, GCP). Deep hands-on architecture experience with SSE platforms (Zscaler, Palo Alto Prisma Access, or equivalent), ZTNA design, and enterprise segmentation programs . Strong command of NIST SP 800-207 and practical zero trust network design in hybrid environments (on-prem, Azure, AWS, GCP). Working knowledge of DNS security, SD-WAN, cloud-native network controls, and network detection and response (NDR) integration points. Experience with cloud workload protection, CNAPP, CSPM, and cloud security posture management. Familiarity with network compliance, conditional access, and identity-driven security controls. Professional certifications such as CISSP, SABSA, or relevant cloud security certifications. You will join the Infrastructure Security Architecture team within Information Security Risk Management (ISRM), serving as the dedicated security architecture partner for BCG’s Secure Network Engineering Squad. In this role, you will help define the security strategy, architectural standards, and governance that guide the design and evolution of secure network platforms spanning SSE, segmentation, DNS, and cloud network infrastructure. You will collaborate closely with engineering, cloud, identity, infrastructure, and security teams across BCG’s global technology organization to ensure security controls are consistently designed, implemented, and governed across the network domain. You will also partner with Security Operations, Risk Management, and architecture peers to strengthen Zero Trust capabilities, advance security maturity, and support enterprise-wide cybersecurity initiatives. Working within a highly collaborative, matrixed environment, you will influence technical direction, build alignment on architectural decisions, and help teams deliver secure, scalable solutions that balance business objectives, operational effectiveness, and risk management. For this role, you will generally be expected to work from a BCG office or in person with clients on a regular basis (typically around 50% of working time), depending on business needs and in line with local policies and practices. You’re Good At . Translating enterprise security standards into practical, implementable engineering requirements. Holding architecture authority constructively: enabling delivery teams rather than blocking them, while keeping governance boundaries intact. Communicating precisely across engineering squads, architecture peers, and senior security leadership.