Lead - Enterprise Security Architect

ROLE PURPOSE
The Enterprise Security Architect defines and governs the organisation's security
architecture strategy, ensuring that all enterprise and solution designs are secure,
compliant, and resilient by design.
The role provides both strategic leadership and hands-on architectural guidance,
embedding security principles, controls, and automation into every aspect of
Petrofac's hybrid and multi-cloud environment — covering applications, data,
infrastructure, and integration layers.
Acting as the bridge between cybersecurity governance and technology delivery,
the Security Architect defines security reference architectures, policies, and
standards, ensuring these are implemented through modern DevSecOps practices,
zero-trust models, and continuous compliance automation.
Working closely with Cloud, Data, and Integration Architects to design secure
platforms and data flows — and with Solution and Technical Architects to embed
secure patterns into projects — the Security Architect ensures consistent and
measurable security across the enterprise technology landscape.
This role combines enterprise governance (standards, frameworks, and compliance)
with solution-level delivery support, enabling secure-by-design outcomes across
projects while ensuring all security architecture decisions deliver tangible business
value through risk reduction, compliance assurance, and operational resilience.

• Define and maintain the enterprise security architecture, including reference architectures,
  

control frameworks, and technology standards across applications, infrastructure, integration,
and data domains.

• Establish and enforce secure-by-design principles and reusable security patterns for new
  

systems, platforms, and integrations.

• Embed security into the delivery lifecycle, ensuring DevSecOps adoption (automated testing,
  

policy-as-code, CI/CD integration).

• Lead implementation of the Zero-Trust model, covering identity, device, network, application,
  

and data layers.

• Collaborate with Cloud & Infrastructure Architects to ensure secure configurations, network
  

segmentation, and identity management across hybrid and multi-cloud environments (Azure,
OCI, on-prem).

• Partner with Data and Integration Architects to secure data flows, APIs, and event-driven
  
  
  

architectures.

• Define and maintain security baselines — encryption, secrets management, access control,
  

and key rotation policies.

• Conduct architecture and design reviews for major projects, ensuring alignment with
  

enterprise guardrails and regulatory obligations.

• Establish and track security metrics and KPIs, including control coverage, vulnerability
  

remediation rates, and compliance posture.

• Provide leadership for incident-response architecture, ensuring resilience, containment, and
  

recovery capabilities are built into designs.

• Engage with business stakeholders to balance risk appetite with operational needs, ensuring
  

that security remains an enabler of business agility.
Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, or related discipline.
• 8–10 years experience in enterprise or solution security architecture,
  

preferably within large, regulated, or asset-heavy environments (oil & gas,
energy, or engineering).

• Strong understanding of security architecture frameworks and standards,
  

Including

• NIST CSF, ISO 27001, CIS Benchmarks, SABSA, TOGAF Security, or
  

Zero-Trust Architecture (ZTA).

• Certified in one or more of:
• CISSP (Certified Information Systems Security Professional)
• SABSA Chartered Security Architect
• Microsoft Certified: Cybersecurity Architect Expert
• Certified Cloud Security Professional (CCSP)
• GIAC Cloud Security Automation (GCSA) (desirable)
• Hands-on experience securing Microsoft Azure and Oracle Cloud
  

Infrastructure (OCI) environments, including identity, networking, and
workload protection.

• Experience implementing DevSecOps pipelines and automation, using:
• SAST/DAST/IAST/SCA tools (e.g., SonarQube, Checkmarx, OWASP
  

ZAP, Fortify)

• IaC security scanning (Terraform Sentinel, Checkov, Azure Policy,
  

Defender for Cloud)

• Container and pipeline security (Aqua, Prisma, GitHub Advanced
  

Security, Defender for Containers)

• Strong understanding of Identity & Access Management (Entra ID, MFA,
  

Conditional Access, PAM) and encryption/key management (Azure Key
Vault, OCI Vault).

• Knowledge of SIEM, SOAR, and XDR platforms (Sentinel, Splunk, Defender
  

XDR) and how architecture supports detection and response.

• Experience using Enterprise Architecture repositories (Orbus Infinity, LeanIX,
  

Sparx EA) and proficiency with ArchiMate or UML for documenting security
models and dependencies.

• Familiarity with compliance and regulatory frameworks (GDPR, NCA,
  

ADHICS, ISO 27001 certification) and their application to cloud and
enterprise systems.
Additional Information