Senior Enterprise Security Architect

About AlphaSense: The world’s most sophisticated companies rely on AlphaSense to remove uncertainty from decision-making. With market intelligence and search built on proven AI, AlphaSense delivers insights that matter from content you can trust. Our universe of public and private content includes equity research, company filings, event transcripts, expert calls, news, trade journals, and clients’ own research content. The acquisition of Tegus by AlphaSense in 2024 advances our shared mission to empower professionals to make smarter decisions through AI-driven market intelligence. Together, AlphaSense and Tegus will accelerate growth, innovation, and content expansion, with complementary product and content capabilities that enable users to unearth even more comprehensive insights from thousands of content sets. Our platform is trusted by over 6,000 enterprise customers, including a majority of the S&P 500. Founded in 2011, AlphaSense is headquartered in New York City with more than 2,000 employees across the globe and offices in the U.S., U.K., Finland, India, Singapore, Canada, and Ireland. Come join us! About the Role We are looking for an Enterprise Security Architect to join AlphaSense's Corporate Technology organization. Reporting directly to the VP of Secure IT, this is a senior individual contributor role responsible for defining and driving the security architecture strategy across our entire enterprise technology landscape — spanning Zero Trust, identity, network, SaaS, endpoint, internal infrastructure, mobile, and operational technology. You won't be handed a finished program. You will design it. Working at the intersection of security engineering, enterprise architecture, and business strategy, you will establish the frameworks, reference architectures, and technical standards that govern how AlphaSense builds and operates its technology environment securely at scale. This role requires deep technical expertise paired with the ability to influence executive stakeholders, shape cross-functional programs, and operate as a force multiplier across Security Operations, Integrated IT, Information Engineering, and the business. At the Staff level, you will: • Own the architecture: Define and maintain the enterprise security architecture across Zero Trust, identity, network, endpoint, SaaS, infrastructure, mobile, and OT domains. • Set the standard: Author and govern security architecture principles, reference designs, and technical standards adopted across the organization. • Lead without authority: Drive alignment across Security Operations, Corporate Technology, Information Engineering, and Integrated IT teams through technical credibility and structured decision-making. • Anticipate risk: Identify architectural gaps and emerging threat vectors before they become incidents, and prescribe remediation roadmaps. • Accelerate programs: Provide architecture leadership for strategic security initiatives including Zero Trust maturity, identity consolidation, SaaS governance, and device trust. Responsibilities Zero Trust & Network Security Architecture • Define and own the Zero Trust and Device Trust architecture strategy, including network segmentation, ZTNA policy design, and enforcement model across corporate and remote environments. • Architect Cloudflare WARP/Access and equivalent controls for secure remote access, replacing legacy VPN patterns with identity-aware, context-driven enforcement. • Design network security architecture for all office and data center environments including Meraki SD-WAN, firewall policy, 802.1X, and DNS security. • Establish architecture standards for microsegmentation, East-West traffic inspection, and lateral movement prevention. Identity & Access Architecture • Own the enterprise identity architecture spanning Okta, SAML/OIDC federation, SCIM provisioning, MFA, Privileged Access Management (PAM), and lifecycle governance across AlphaSense and Tegus tenants. • Design device trust and certificate-based authentication frameworks integrating MDM (Kandji, Intune), Okta FastPass, TPM/Secure Enclave, and hardware-bound credentials. • Define role-based access control (RBAC) architecture and Joiner-Mover-Leaver (JML) automation patterns for consistent enforcement across 200+ enterprise applications. • Architect identity federation patterns for M&A integrations, third-party partners, and customer-facing systems. Endpoint & Mobile Security Architecture • Define the enterprise endpoint security architecture across macOS, Windows, and mobile platforms, including EDR (CrowdStrike Falcon), MDM policy standards, and patch management architecture. • Design mobile device management architecture for corporate and BYOD scenarios, establishing enrollment profiles, compliance policies, and conditional access integration. • Establish architecture standards for endpoint hardening, application allow-listing, DLP controls, and removable media policy. • Provide architectural oversight for RMM tooling and remote management capabilities, ensuring security boundaries and abuse-resistance controls are embedded by design. SaaS & Cloud Security Architecture • Define the SaaS security architecture program: vendor risk tiering, security review criteria, integration security standards, and ongoing posture monitoring frameworks. • Architect CASB, SSPM, and SaaS access governance controls to ensure visibility and enforcement across the business application portfolio. • Establish data classification and DLP architecture for SaaS environments including Google Workspace, Microsoft 365, Salesforce, and Workday. • Design AI/shadow SaaS governance architecture, including browser isolation, OAuth scope enforcement, and sanctioned AI tooling controls. Internal Infrastructure Security Architecture • Define security architecture standards for on-premise and cloud-hosted internal infrastructure including IDF/MDF environments, server rooms, physical access control systems (Brivo), and AV infrastructure. • Architect logging, SIEM integration, and telemetry collection frameworks ensuring consistent visibility across infrastructure, identity, network, and endpoint layers. • Design disaster recovery and resilience architecture for critical corporate infrastructure, including offline backup strategies and clean-room recovery playbooks. Operational Technology (OT) Security • Develop OT security architecture standards for physical and building systems including access control hardware, environmental sensors, and network-connected facility equipment. • Define segmentation and monitoring architecture to isolate OT environments from corporate IT networks, reducing blast radius and unauthorized access risk. • Establish a vulnerability management framework for OT assets, accounting for patching constraints and availability requirements unique to operational environments. Architecture Governance & Engineering Enablement • Maintain a living enterprise security architecture document and domain-level reference architectures, keeping them current with technology changes and threat landscape evolution. • Conduct security architecture reviews for new technology programs, vendor onboarding, and significant infrastructure changes — providing actionable guidance rather than just approval/denial. • Define security requirements and acceptance criteria for strategic projects in partnership with Product Security, Engineering, and Corporate Technology. • Produce architecture decision records (ADRs) and security design patterns that teams can reuse, reducing review cycle time and engineering rework. Qualifications Required • 8+ years of experience in information security with at least 4 years in a security architecture, security engineering lead, or equivalent senior technical role. • Demonstrated expertise designing and implementing Zero Trust architectures in enterprise environments, including ZTNA, identity-aware access, and microsegmentation. • Deep knowledge of identity and access management — Okta (or equivalent), SAML, OIDC, SCIM, MFA, PAM, and certificate-based authentication. • Strong endpoint security architecture experience across macOS and Windows, including EDR (CrowdStrike preferred), MDM (Kandji/Intune), and patch management. • Experience architecting SaaS security programs including vendor risk frameworks, CASB/SSPM tooling, and OAuth/API integration controls. • Solid understanding of network security architecture: firewalls, SD-WAN, 802.1X, DNS security, and network segmentation principles. • Familiarity with OT/IoT security architecture concepts and the challenges of securing non-traditional network-connected assets. • Proven ability to produce high-quality security architecture documentation including reference architectures, design patterns, and ADRs. • Strong communicator capable of presenting complex security topics to both technical peers and senior non-technical stakeholders. Nice to Have • Professional certifications: CISSP, SABSA, CCSP, or equivalent architecture/security credentials. • Experience operating in a post-M&A environment with multi-tenant identity and infrastructure consolidation challenges. • Familiarity with Cloudflare Access/WARP, Meraki, CrowdStrike Falcon, Kandji, Qualys VMDR, or Drata/GRC tooling. • Experience designing AI governance and shadow SaaS controls for enterprise environments. • Background working in a regulated industry or supporting compliance frameworks (SOC 2, ISO 27001, FedRAMP). AlphaSense is an equal-opportunity employer. We are committed to a work environment that supports, inspires, and respects all individuals. All employees share in the responsibility for fulfilling AlphaSense’s commitment to equal employment opportunity. AlphaSense does not discriminate against any employee or applicant on the basis of race, color, sex (including pregnancy), national origin, age, religion, marital status, sexual orientation, gender identity, gender expression, military or veteran status, disability, or any other non-merit factor. This policy applies to every aspect of employment at AlphaSense, including recruitment, hiring, training, advancement, and termination. In addition, it is the policy of AlphaSense to provide reasonable accommodation to qualified employees who have protected disabilities to the extent required by applicable laws, regulations, and ordinances where a particular employee works. Recruiting Scams and Fraud We at AlphaSense have been made aware of fraudulent job postings and individuals impersonating AlphaSense recruiters. These scams may involve fake job offers, requests for sensitive personal information, or demands for payment. Please note: • AlphaSense never asks candidates to pay for job applications, equipment, or training. • All official communications will come from an @alpha-sense.com email address. • If you’re unsure about a job posting or recruiter, verify it on our Careers page. If you believe you’ve been targeted by a scam or have any doubts regarding the authenticity of any job listing purportedly from or on behalf of AlphaSense please contact us. Your security and trust matter to us.