Global Cybersecurity Senior Manager - Architecture

Role overview

Global Cybersecurity Senior Manager - Architecture at BCG

In this role, you will own the governance and technical architecture requirements that protect data across loss prevention, classification enforcement, encryption, and secrets management.

Responsibilities

• Conduct security architecture reviews for secure data initiatives; issue dispositions, conditions, and architectural decision records traceable to ISRM governance.
• You will also partner with Security Operations, Risk Management, and architecture peers to advance Zero Trust Data pillar maturity and support enterprise-wide cybersecurity initiatives.

Employment details

• Strong understanding of zero trust architecture (NIST SP 800-207, CISA ZTMM), enterprise control frameworks, and hybrid cloud environments (Azure, AWS, GCP).
• Location: Gurgaon [Haryana] [India]

Application details

• Define secure data access patterns for infrastructure-managed data stores and application interfaces, preventing unauthorized access, exposure, or tampering.

About the employer

• As the Infrastructure Security Architect – Secure Data, you will serve as the dedicated security architecture partner for BCG’s Secure Data Engineering Squad, owning the cyber defense governance and technical protection requirements for data security architecture covering data loss prevention, classification enforcement, encryption, and secrets management.
• For this role, you will generally be expected to work from a BCG office or in person with clients on a regular basis (typically around 50% of working time), depending on business needs and in line with local policies and practices.

Additional role details

• You will ensure the Secure Data portfolio aligns with BCG’s Global Information Security Policy (GISP), the Cybersecurity Control Framework (CSF-10 (Data Protection)), the Security Architecture Reference Model, and the CISA Zero Trust Maturity Model (Data pillar), embedding security from design through delivery while preserving control integrity and audit defensibility.
• Define and maintain data security architecture: data loss prevention (DLP), data classification and tagging enforcement, encryption, and data privacy governance interfaces.
• Own architectural requirements for Microsoft Purview enforcement: sensitivity labeling, auto-labeling policy design, DLP policy architecture across endpoints, email, and cloud services.
• Define data classification enforcement architecture in alignment with the Global Data Classification Policy and Global Data Protection Policy, ensuring controls scale with data sensitivity.
• Own encryption and key management architecture requirements for infrastructure-managed data, including interfaces to secrets management and enterprise key management platforms including crypto-agility and post-quantum cryptography (PQC) migration readiness for infrastructure-managed data and key material.
• Architect DLP coverage for emerging data egress channels, including AI-enabled tooling and agentic workflows, in coordination with Enterprise Security Architecture.
• Author and maintain the security standards, reference architectures, and control requirements that govern the Secure Data domain, mapped to CSF-10 (Data Protection) and ZTMM maturity targets.
• Contribute domain expertise to ZTMM maturity assessments, control gap analyses, and the security architecture roadmap.
• Serve as the dedicated architecture counterpart to the Secure Data Engineering Squad, validating feasibility and effectiveness of security controls through implementation without assuming delivery ownership.
• Define logging, telemetry, and monitoring requirements (CSF-12) for secure data services in partnership with Security Operations, which owns SIEM, detection engineering, and continuous monitoring.
• Bachelor’s degree in a relevant field or equivalent practical experience. 6–10 years in security architecture, security engineering, or infrastructure security with demonstrated architecture responsibility.
• Experience operating in large, audit-sensitive, or regulated enterprise environments with formal governance and exception processes.
• Deep hands-on architecture experience with Microsoft Purview (Information Protection, DLP), enterprise data classification programs, and encryption architecture.
• Working knowledge of key management and secrets management platforms (e.g., HashiCorp Vault, cloud-native KMS/HSM), BYOK patterns, and cryptographic standards lifecycle.
• Familiarity with insider risk, data egress monitoring, and DLP enforcement across endpoint, network, and SaaS channels.
• Professional certifications such as CISSP, SABSA, or relevant cloud security certifications.
• You will join the Infrastructure Security Architecture team within Information Security Risk Management (ISRM), serving as the dedicated security architecture partner for BCG’s Secure Data Engineering Squad.
• You will collaborate closely with engineering, cloud, identity, infrastructure, and security teams across BCG’s global technology organization to ensure data security controls are consistently designed, implemented, and governed.
• Working within a highly collaborative, matrixed environment, you will influence technical direction, build alignment on architectural decisions, and help teams deliver secure, scalable solutions that balance business objectives, operational effectiveness, and risk management.
• You’re Good At .
• Translating enterprise security standards into practical, implementable engineering requirements.
• Holding architecture authority constructively: enabling delivery teams rather than blocking them, while keeping governance boundaries intact.
• Communicating precisely across engineering squads, architecture peers, and senior security leadership.