Summary / Objective
The Principal Cloud Security Architect owns the architecture and technical safeguards behind LIO's AWS environment as our applications, integrations, and AI capabilities grow. This is a hands-on individual contributor role, not a people-management role: the incumbent designs, builds, and secures cloud infrastructure directly, sets standards adopted across teams, and partners with the fractional CISO and GRC team to support security governance and regulatory examinations.
Essential Duties & Functions
- Own AWS infrastructure architecture, including account structure, networking, identity, compute, storage, connectivity, and environment separation.
- Establish reusable infrastructure patterns and guardrails with infrastructure as code, version control, and automated deployment checks.
- Design for availability, recovery, performance, and cost; make practical tradeoffs based on workload and business needs.
- Partner with Enterprise Architecture on standards and design reviews, translating application and integration requirements into secure, supportable cloud infrastructure.
- Set technical requirements for cloud engineering providers, review their designs and implementation, and contribute hands-on to critical changes and complex troubleshooting.
- Define architecture and control standards for cloud services, endpoints, identity, and connectivity, partnering with IT Operations on implementation and supportability.
- Design observability, escalation patterns, and technical runbooks; agree operational handoffs and coverage with the accountable service owners.
- Design infrastructure backup and recovery capabilities; work with business and application owners to define recovery objectives and validate restoration with IT Operations and providers.
- Improve operational performance through automation, capacity planning, root-cause analysis, and disciplined change management.
- Evaluate infrastructure and security tooling, identify cloud cost improvements, and recommend lifecycle investments to the accountable budget owner.
- Implement the technical controls supporting LIO's security program across AWS, identity platforms, Microsoft 365, endpoints, networks, and shared infrastructure.
- Strengthen privileged access, authentication, segmentation, encryption, secrets management, logging, and data protection.
- Define infrastructure vulnerability remediation patterns, implement complex fixes, and coordinate technical remediation with application and service owners using agreed priorities and deadlines.
- Establish effective detection and response capabilities with internal teams and providers; lead technical containment and recovery during incidents.
- Partner with engineering on secure deployment practices and with AI/data owners on workload identity, access boundaries, sensitive-data protection, and monitoring.
- Produce operating evidence, support control assessments, and resolve findings in partnership with the CISO and GRC lead.
- Mentor engineers and operational staff, document design decisions, and build reusable patterns that reduce dependence on individual experts.
- Shape the multi-year cloud security architecture and technical roadmap; agree delivery priorities and capacity with the CTO/CIO, CISO, and functional leaders.
- Translate technical issues into clear choices about risk, cost, service impact, and delivery timing.
- Set technical acceptance criteria for providers, review implementation quality, and retain architecture knowledge and documentation within LIO.
- Escalate unresolved risks, resource constraints, and control exceptions promptly through the agreed governance process.
- Participate in special projects and other duties as assigned.
LIO LIFE — What We Value
- The Customer Lens -- Prioritizing our relationships, service, and needs of our customers.
- Innovative Thinking -- Fostering an environment that empowers and sustains bold thinking and actions.
- Balance -- Creating an inclusive, diverse, and holistic balance to meet our personal and professional needs.
- Simplicity -- Striving for simplicity in our service, products, and processes.
- Accountability -- Owning our results and learning from them.
Qualifications
To perform this job successfully, an individual must be able to perform each essential duty satisfactorily. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.
- Deep, current AWS architecture and engineering experience, particularly networking, IAM, resilience, logging, and infrastructure security.
- Demonstrated hands-on ability with infrastructure as code and automation, using tools such as Terraform, CloudFormation, or CDK and a scripting language such as Python, PowerShell, or Bash.
- Practical security engineering experience across identity, access control, vulnerability remediation, monitoring, and incident response.
- Experience operating production services with defined service expectations, tested recovery procedures, and accountable incident follow-through.
- Track record of setting architecture standards across teams, mentoring senior engineers, reviewing provider implementations, and influencing investment decisions without direct reporting authority.
- Clear communication with engineers, business leaders, and risk/compliance partners, supported by useful technical documentation.
- Ability to thrive in a virtual, global organization and effectively manage competing priorities.
Required Education and Experience
- Bachelor's Degree in Computer Science, Information Technology, or a related field (or equivalent practical experience).
- Typically 12 or more years of relevant cloud infrastructure, platform engineering, or security engineering experience, with sustained organization-wide architectural impact; level is based on demonstrated capability, not tenure alone.
- Demonstrated track record of setting technical direction and influencing outcomes across teams without direct reporting authority.
Preferred Education and Experience
- Experience in insurance, financial services, or another regulated environment.
- Familiarity with Microsoft 365, Intune, Okta or Entra ID, and endpoint security platforms.
- Experience with Datadog or comparable observability and security monitoring tools.
- Experience integrating security checks into software delivery and securing AI or LLM workloads.
- Familiarity with NIST CSF, control assessments, and evidence supporting regulatory examinations.
Additional Eligibility Requirements (Certificates, Licenses, Required/Preferred)
- Relevant AWS, cloud security, or information security certifications preferred; demonstrated delivery experience is equally valued.
LIO Life — Our Benefits
LIO offers a comprehensive benefits package designed to support your health, financial security, and work-life balance. Benefits are effective on your date of hire.
Health & Wellness
- Medical coverage with a choice of plan options, including preventive care and prescription drug coverage.
- Dental, Vision, and Prescription coverage.
- Health Savings Account (HSA) with employer contributions.
- Flexible Spending Accounts (FSA) for healthcare and dependent care expenses.
Financial Protection
- Employer-paid Basic Life & AD&D coverage.
- Employer-paid Short-Term Disability coverage.
- Employer-paid Long-Term Disability coverage.
- Voluntary Life & AD&D coverage available for employees and their families.
- 401(k) Retirement Savings plan.
Additional Perks
- Flexible Time Off.
- Employee Assistance Program (EAP) — confidential support for personal and work-related challenges.
- Voluntary Pet Insurance.
- Career development with clear performance goals, coaching, and opportunities to lead initiatives.
- Community involvement and volunteer opportunities supported by leadership.
Work Environment
This role operates in a remote/hybrid work environment with regular virtual collaboration across IT, security, and business teams. This role routinely uses standard office and computing equipment.
Position Type / Expected Hours of Work
This is a full-time position. Expected days and hours of work are Monday through Friday, 8:30 a.m. to 5:00 p.m. This position may require extended hours, occasional weekend work, and off-hours availability to support incident response based on business need.
Travel
Minimal travel required; occasional travel for team, vendor, or leadership meetings as needed.
EEO Statement
LIO Insurance provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type without regard to race, color, creed, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state, or local laws. This policy applies to all terms and conditions of employment, including recruiting, hiring, placement, promotion, termination, layoff, recall, transfer, leaves of absence, compensation, and training.
Other Duties
Please note this job description is not designed to cover or contain a comprehensive listing of activities, duties, or responsibilities that are required of the employee for this job. Duties, responsibilities, and activities may change at any time with or without notice.