About Oakwood Systems Group Oakwood Systems Group is a leading IT professional services firm and recognized Microsoft Solutions Partner spanning Application Development, Data & AI, Cloud Infrastructure, Modern Work, and Managed Services. We help organizations modernize and create business value through innovative, scalable, secure Microsoft solutions. Our consultative, outcome-driven teams guide clients from strategy through execution using Azure, Microsoft Fabric, AI/ML, and intelligent applications. We hire top talent and foster collaboration, high performance, innovation, continuous learning, and professional growth through meaningful projects that deliver measurable impact across industries. About the Role The Principal Security Architect is the hands-on technical and team leader for Oakwood’s Security Solutions Group, delivering customer security projects and helping establish managed-services security offerings. The role leads customer security strategy, architecture, and delivery across Azure, Microsoft 365, and hybrid environments. It translates business goals, risks, and operational needs into architectures and prioritized roadmaps across Cloud Infrastructure, Data & AI, Application Development and agents, Modern Work, and Managed Services. As a trusted advisor to customer security and technology leaders, the architect owns technical direction and delivery quality, validates designs, and supports implementation, pre-sales, repeatable offerings, and recurring-service maturity. The role integrates security with other practices through their specialists and delivery leaders without assuming their ownership. Initial priorities are to deliver customer security projects and turn repeatable delivery patterns into managed security offerings with agreed scope, deliverables, pricing inputs, support boundaries, runbooks, and readiness criteria. Work with managed-services and sales leaders to validate these offerings through initial customer engagements and operational handoffs before expanding recurring-service commitments. The architect leads a small team delivering projects and managed services through coaching, skills development, work allocation, capacity planning, and delivery accountability. Formal personnel duties follow Oakwood’s reporting structure. The role partners with project, service-line, and managed-services leaders on commercial and operational outcomes; it does not independently own a 24×7 SOC or all incident-response coverage.
Key Responsibilities
- Lead discovery, security assessments, architecture workshops, and roadmap discussions to define business goals, threats, constraints, and success criteria.
- Turn findings into current- and target-state architectures, remediation backlogs, roadmaps, estimates, assumptions, dependencies, and risks. Track maturity through posture reviews and executive reporting using agreed measures for control adoption and coverage, priority exposures, remediation, agent governance, detection quality, investigation efficiency, operational readiness, and service efficiency - not a single security score.
- Architect cloud and hybrid Zero Trust across identity, privileged access, devices, networks, applications, infrastructure, and data.
- Design identity and network access with Microsoft Entra ID, Conditional Access, MFA, identity governance, Privileged Identity Management, workload and agent identities, and hybrid identity. Apply Entra Global Secure Access - Internet Access and Private Access - where appropriate to secure user and agent access to applications, AI services, and private resources.
- Architect Azure and hybrid security foundations: landing zones, management groups, Azure Policy, RBAC, segmentation, private connectivity, encryption, key management, logging, and Defender for Cloud. Partner with infrastructure specialists on datacenter modernization and HPC/GPU security as needed.
- Design threat protection and security operations with Microsoft Sentinel and Defender, balancing telemetry coverage, ingestion and retention costs, detection quality, investigations, automation, and operational handoff.
- Evaluate and operationalize Microsoft Security Copilot and security agents across Defender, Entra, Intune, and Purview for investigation, triage, posture management, and service efficiency. Apply least privilege, human oversight, validation, and cost controls consistent with licensing, feature availability, and operational readiness.
- Guide Modern Work security for email, collaboration, external sharing, endpoints, device lifecycle, and data protection using Microsoft Defender, Intune, and Purview, aligned to customer needs, readiness, and licensing.
- Lead security reviews and threat modeling for migrations, applications, APIs, connectors, copilots, and agents. Partner with application specialists on workload and agent identities, authorization, secrets, data exposure, monitoring, and secure development.
- Govern enterprise AI and agent lifecycles: discovery, inventory, ownership, onboarding, identity, least privilege, policy enforcement, monitoring, and retirement. Use Microsoft Agent 365, Entra, Defender, and Purview as requirements, licensing, and feature availability permit.
- Partner with Data & AI specialists on permissions, classification, protection, governance, and monitoring for Microsoft Fabric, analytics, and AI data access; define control ownership and implementation responsibilities.
- Partner with infrastructure and managed-services owners on protected backups, administrative separation, ransomware recovery readiness, and recovery validation against customer continuity and disaster recovery requirements.
- Map controls to customer policies and frameworks such as NIST, CIS, and ISO 27001; distinguish architecture guidance from formal compliance certification.
- Create architecture diagrams, designs, decision records, control mappings, implementation plans, validation criteria, and executive recommendations.
- Lead hands-on delivery: validate designs and configurations, resolve complex issues, review implementation quality, and guide engineering decisions and customer acceptance.
- Lead the small Security Solutions Group through technical direction, people leadership, coaching, skills development, work allocation, and project and service accountability; coordinate formal personnel duties with the reporting leader.
- Coordinate staffing, capacity, workload, and utilization with project and managed-services leaders; balance milestones, service commitments, and escalations while addressing resource and coverage gaps.
- Oversee project scope, milestones, acceptance, and risks. Partner with engagement and managed-services leaders on estimate accuracy, change control, delivery margin, service effort, and automation within the role’s authority.
- Oversee recurring-service scope, runbooks, change control, service levels, posture reviews, and improvement. Define ownership, ticket routing, escalation authority, and coverage with the service desk, managed services, customers, and SOC/MDR partners. Coordinate incidents with operational owners; do not assume independent 24×7 monitoring or response ownership.
- Manage project-to-service transitions through readiness reviews, knowledge transfer, support documentation, monitoring requirements, and clear ownership. Use delivery and service trends to prioritize automation, remediation, and improvement.
- Develop solution approaches, estimates, SOWs, and customer presentations with account teams, engagement managers, engineers, and architects.
- Connect immediate security needs to follow-on opportunities in identity, cloud, data protection, security operations, and managed services.
- Align offerings with Microsoft’s secure AI and AI-ready productivity conversations, co-sell, applicable partner investments, and Marketplace routes alongside sales and alliance teams. Support skilling and delivery evidence; designated owners retain alliance administration and eligibility decisions.
- Use reference architectures, delivery standards, and knowledge-sharing practices to turn repeatable project work into packaged assessments, implementations, and recurring security services. Define each offering’s scope, deliverables, pricing inputs, acceptance, and support boundaries with sales and service-line leaders.
Customer-Facing and Consulting Expectations
- Lead consulting discovery, whiteboarding, solution presentations, and executive security briefings.
- Build trust with CISOs, CIOs, security leaders, architects, engineers, and business stakeholders; communicate clearly across technical and non-technical audiences.
- Uncover unstated needs and explain tradeoffs, residual risk, cost, licensing, complexity, and operational impact without over-engineering.
- Align security, infrastructure, application, data, compliance, and business teams with differing priorities.
- Exercise professional judgment in difficult conversations, exception documentation, and expectation management.
- Own technical quality and customer outcomes through proactive communication, accurate documentation, and follow-through.
Required Qualifications
- 10+ years in cybersecurity, infrastructure, identity, or cloud engineering, including 5+ years designing and delivering Microsoft security solutions and significant architecture leadership.
- Ownership of complex customer security architecture from assessment and design through implementation, validation, and operational transition.
- Small-team technical and people leadership across security projects and managed services, including coaching, resourcing, delivery, service levels, escalations, and operational transitions.
- Deep hands-on expertise in at least two domains - identity and access, Azure/hybrid security, Microsoft 365 security, security operations, or data protection - with architectural breadth across the others. Ability to guide cross-practice specialists; implementation expertise in every Oakwood service is not expected.
- Strong knowledge of Entra ID, hybrid Active Directory security, Conditional Access, privileged access, least privilege, and identity lifecycle management.
- Experience with Azure Policy, RBAC, network security, private endpoints, Key Vault, logging, and Defender for Cloud.
- Architectural knowledge of Sentinel/Defender integration, detection engineering, incident workflows, telemetry costs, and security operations, with hands-on depth in core domains.
- Working knowledge of Purview information protection and DLP, Intune compliance, and email and collaboration protection; engage implementation specialists outside core expertise.
- Practical application of Zero Trust, threat modeling, security baselines, and risk-based prioritization.
- Architectural familiarity with AI and agent inventory, ownership, identity/access lifecycle, policies, monitoring, and retirement; ability to evaluate Agent 365 and AI-enabled security operations with appropriate oversight as capabilities evolve.
- PowerShell, Kusto Query Language (KQL), and infrastructure-as-code or security automation skills sufficient to validate designs and guide implementation.
- Ability to create architecture documents, recommendations, estimates, plans, and executive presentations; understand scope control, project economics, service effort, and measurable security outcomes.
- Excellent consulting, presentation, whiteboarding, and writing skills; ability to lead multiple workstreams amid ambiguity and change.
Preferred Qualifications
- Advanced Microsoft security certifications, CISSP, CCSP, or comparable demonstrated expertise.
- Regulated-industry security design and translation of audit or regulatory requirements into controls and evidence.
- Purview governance, retention, insider risk, or broader information protection programs.
- Security for Fabric, analytics, AI applications, copilots, and agents: permissions, classification, workload/agent identities, API/connector authorization, oversharing, and monitoring.
- Agent 365, Security Copilot/security agent, or Entra Global Secure Access pilots or implementations, including governance, human oversight, validation, and licensing or consumption considerations.
- DevSecOps, Terraform or Bicep, CI/CD controls, container security, and application security collaboration.
- Cyber resilience, protected backups, ransomware readiness, or continuity/disaster recovery validation; datacenter modernization or HPC/GPU security familiarity is a plus.
- Security platform consolidation, licensing assessments, operating models, and managed-service transitions.
- Microsoft-aligned engagements, co-sell, partner investments, Marketplace offerings, or capability development through skilling and delivery evidence.
- Packaged consulting and recurring security offerings: assessment methods, service boundaries, pricing inputs, maturity roadmaps, reference architectures, and accelerators.
Principal-Level Differentiators
- Own cross-domain security architecture, resolve cross-team design decisions, and escalate material risks with clear recommendations.
- Advise executives on security investments linked to business priorities, risk reduction, operational maturity, and measurable outcomes.
- Combine strategy with hands-on configuration validation, complex troubleshooting, and guidance on difficult delivery decisions.
- Shape pursuits and offerings with defensible scope, estimates, pricing inputs, operating boundaries, and delivery methods aligned to customer expectations and Oakwood’s capabilities and commercial goals.
- Scale a small team through coaching, capacity planning, architecture reviews, reusable patterns, and automation; connect projects to sustained service maturity and customer outcomes.
- Integrate security across Cloud Infrastructure, Modern Work, Application Development and agents, Data & AI, and Managed Services while respecting practice ownership and operational responsibilities.
Work Authorization: At this time, we are unable to provide visa sponsorship or transfer sponsorship for employment. Applicants must be authorized to work in the United States without current or future sponsorship requirements.