Principal Cybersecurity Architect - Lab & Customer Infrastructure

Job Description

Job Title: Principal Cybersecurity Architect – Lab & Customer Infrastructure Contract Type / Duration: Contract – 6 Months Location: Remote – United States Work Hours: 40 Hours per Week Job Summary / Overview We are seeking a Principal Cybersecurity Architect to design and govern security for complex, customer-facing lab and infrastructure environments. These environments support multiple customers simultaneously and require strict tenant isolation, secure external connectivity, strong identity controls, and secure provisioning and decommissioning practices. This is a hands-on architecture role, not a policy-only or governance position. The architect must be able to work directly with security and infrastructure engineers, design detailed technical controls, resolve architectural challenges in real time, and communicate recommendations effectively to audiences ranging from engineers and developers to executives. The ideal candidate combines deep network security and multi-tenant architecture with recent hands-on expertise in identity security, Zero Trust, phishing-resistant MFA, non-human identities, privileged access, device trust, and secure remote access. Top Required Skills – Ranked 1. Hands-On Identity & Zero Trust Architecture Recent architecture experience across both workforce and non-human identities, including: Service principals and service accounts Managed identities Secrets management Privileged Access Management (PAM) Phishing-resistant MFA Certificate-based authentication Device trust / device compliance Least-privilege access Identity lifecycle and access controls 2. Network Security & Multi-Tenant Isolation Deep experience designing secure infrastructure environments using: Network segmentation Micro-segmentation VLANs Firewall zoning Inter-VLAN routing controls Zero Trust segmentation Tenant isolation Secure remote connectivity 3. Cross-Platform Security Architecture Experience designing security across multiple technology ecosystems, identity platforms, infrastructure platforms, and authentication approaches. Candidates whose experience is primarily limited to Microsoft 365/Entra ID are unlikely to be a strong fit.

Key Responsibilities

Design security architecture for multi-tenant customer lab environments Ensure strict isolation between customer environments Develop network segmentation and micro-segmentation architectures Establish firewall zoning and inter-VLAN routing controls Apply Zero Trust principles between tenant environments Develop security standards for provisioning new customer environments Define validation requirements before environments become operational Establish secure decommissioning processes that eliminate residual data and configurations Lead tenant-isolation validation through penetration testing, traffic analysis, and configuration audits Architect secure remote customer connectivity Evaluate and design ZTNA, IPSec/SSL VPN, MPLS, and dedicated connectivity solutions Define external-party identity verification and onboarding requirements Establish MFA, least-privilege, access-scoping, and time-limited access controls Design secure remote-access gateways with comprehensive session logging Integrate access activity into security monitoring platforms Design security controls for workforce and non-human identities Establish secure approaches for service principals, managed identities, secrets, certificates, and privileged accounts Design phishing-resistant authentication and device-trust controls Work directly with identity, security, infrastructure, and network engineers to develop implementable architecture Translate complex security concepts for executives, developers, engineers, and nontechnical stakeholders

Required Qualifications

Principal-level cybersecurity architecture experience Recent hands-on identity security architecture experience Strong understanding of workforce and non-human identity security Experience securing service accounts, service principals, managed identities, and machine identities Strong knowledge of secrets management and PAM Deep understanding of phishing-resistant MFA Experience with certificate-based authentication Experience designing device-trust and device-compliance controls Strong Zero Trust architecture experience Deep network security and segmentation knowledge Experience designing secure multi-tenant environments Experience with VLANs, firewall zoning, micro-segmentation, and routing controls Experience architecting secure external connectivity Strong knowledge of ZTNA, VPN technologies, and least-privilege remote access Experience across multiple platforms and authentication approaches Ability to work directly with senior engineers and technical SMEs Strong consulting and stakeholder communication skills Critical Identity Knowledge Candidates should be able to explain and design technical controls around: Workforce identities Non-human / machine identities Service principals Managed identities Secrets and credential management Privileged Access Management Phishing-resistant MFA FIDO2 / passkeys / hardware-backed authentication concepts Certificate-based authentication Device trust Device compliance Conditional access concepts Least privilege Zero Trust access What We Are NOT Looking For This is not a governance-only security architecture position. Candidates are unlikely to succeed if they: Primarily create policies, standards, and governance documentation without designing technical controls Have identity experience limited primarily to Microsoft 365 or Entra ID Cannot explain modern authentication concepts such as phishing-resistant MFA Approach architecture exclusively from the executive/CISO level Depend on engineers to determine the technical implementation Lack recent hands-on architecture experience Cannot explain technical security concepts to both engineers and nontechnical audiences Additional Notes Remote position within the United States This role requires a collaborative, hands-on architecture approach Candidates must be comfortable working directly with identity engineers, network engineers, infrastructure SMEs, and security teams Strong candidates will be able to challenge and defend technical decisions with senior engineers while remaining collaborative Consulting-level communication is essential Candidate must be eligible for W-2 employment Must be legally authorized to work in the U.S. without current or future sponsorship