Security Consultant and Solution Architect

Pracovní nabídka

The role combines security technology delivery, governance and process consulting with general solution architecture. It translates business needs into practical, secure and supportable solutions, and owns delivery from initial assessment through design, implementation, testing, deployment, operational handover and stabilization. The position supports Financial Services CZ and can deliver projects across other sectors.

Your future duties and responsibilities

• Lead discovery workshops to capture business, security, regulatory and operational requirements, existing processes, dependencies, constraints and acceptance criteria.
• Assess the current environment and risks; design the target solution across applications, data, integration, infrastructure and cloud or hybrid services. Compare options against business value, risk, delivery effort and operating cost.
• Design and deliver SIEM, IAM/IDM and PAM integrations, including interfaces, data flows, access controls and supporting processes. Install and configure services, or guide engineers through implementation and resolve design issues.
• Translate security assessments into proportionate controls, process improvements and remediation plans. Work with governance, risk and compliance teams to define ownership, evidence and audit requirements.
• Coordinate security, infrastructure, application, operations and audit stakeholders; manage technical dependencies, delivery risks and workstreams within Agile or Waterfall projects.
• Define test strategy, hardening requirements, security and integration tests, and acceptance criteria. Review the implemented solution against the approved design and record changes and residual risks.
• Prepare operational monitoring, incident response, change and patch management, backup and disaster recovery arrangements. Deliver training, knowledge transfer, handover and hypercare through stabilization.
• Measure delivery and operational outcomes using agreed KPIs, including log source coverage, detection coverage, identity lifecycle performance and privileged account onboarding. At senior level, mentor colleagues and lead a workstream.

Typical deliverables

• Security and integration assessment, requirements catalogue and risk and remediation register.
• High level and low level designs (HLD/LLD), architecture diagrams, integration specifications, interface contracts and data flow maps.
• Architecture decision records, implementation roadmap and migration, cutover and rollback plans.
• SIEM detection use cases, IAM role and lifecycle models, PAM onboarding standards, and test plans with acceptance criteria.
• Runbooks, operating model, training materials, support ownership and an operational handover package.

Required qualifications to be successful in this role

Experience and core security domains
• Medior: typically 3+ years in security architecture, security engineering or enterprise integration. Senior: typically 5+ years, with evidence of delivery ownership and technical leadership. Experience may come from any sector.
• Infrastructure: practical understanding of networking, Windows and Linux, Active Directory, Microsoft Entra ID, and cloud and hybrid environments. Target 3-5 years of relevant infrastructure experience.
• SIEM: log onboarding, parsing, normalization, correlation, detection use cases, tuning, alerting and reporting; integration with SOAR and ITSM. Understand sources such as EDR, firewalls, IDS/IPS, proxy, server, application and cloud audit logs.
• IAM/IDM: identity lifecycle, provisioning and deprovisioning, SSO, MFA, federation using SAML/OIDC, RBAC/ABAC and access governance. Understand integration with HR systems, directory services, enterprise applications and SaaS.
• PAM: credential vaulting and rotation, session management and recording, approval workflows, just in time and just enough access, and onboarding servers, network devices, databases and application accounts.
• Target 3-5 years of relevant experience in SIEM, IAM/IDM and PAM, with practical installation and configuration capability in at least one domain. Target 3-5 years in GRC, risk management and the ISO 27000 and ISO 31000 families; apply controls and process analysis to delivery.

General solution architecture requirements
• Translate business capabilities and functional requirements into a coherent solution design. Define measurable nonfunctional requirements for availability, performance, scalability, resilience, security, privacy, maintainability and supportability.
• Design application boundaries, data models and flows, integration patterns and interfaces. Select suitable APIs, connectors, syslog, agents and event streaming; account for authentication, authorization, errors and dependencies.
• Evaluate on premises, cloud, hybrid, commercial and custom options. Explain technology selection and build versus buy decisions, including licensing, total cost of ownership, vendor constraints and lifecycle implications.
• Produce clear architecture diagrams, HLD/LLD and decision records. Maintain traceability from requirements to design, implementation and acceptance; align with enterprise standards and architecture governance.
• Plan incremental implementation, migration, cutover and rollback. Validate critical assumptions with prototypes or proofs of concept; review designs and guide delivery teams through technical tradeoffs.
• Design an operating model covering observability, service levels, incident response, change management, patching, backup and disaster recovery, with clear ownership and support handover.

Additional requirements and advantages
Czech and English are required. A formal degree is not required. Strong stakeholder communication, facilitation and documentation skills are essential. Designing and performing security or audit controls, and familiarity with NIST, CIS Controls and ITIL, are advantages.
Useful platform experience includes Microsoft Sentinel, Splunk, QRadar or Elastic; SailPoint, ForgeRock, Keycloak or Microsoft Entra ID; and CyberArk, BeyondTrust or Delinea. SOAR and ITSM integrations, PowerShell or Python automation, and experience in regulated sectors are advantages.

What we offer:

· Share Purchase Plan
· CGI’s My Assistance Program
· Compensation for long term sickness up to 30 days
· Interest-free company loan
· Referral bonus
· Lunch vouchers – 140CZK
· Group life insurance
· Flu and tick vaccination
· MultiSport card
· Cafeteria Benefit System – 900CZK monthly
· Hybrid Working Model & Flexible working hours
· 5 weeks of vacation + 3 sick days
· Birthday Leave and CSR day
And many more…