Security Architect

Careers at CGI

Careers

Search career opportunities

• Create your profile | Sign in
• Activate career alerts

Find similar career opportunities

Position Description:

The role combines security technology delivery, governance and process consulting with general solution architecture. It translates business needs into practical, secure and supportable solutions, and owns delivery from initial assessment through design, implementation, testing, deployment, operational handover and stabilization. The position supports Financial Services CZ and can deliver projects across other sectors.

Your future duties and responsibilities:

• Lead discovery workshops to capture business, security, regulatory and operational requirements, existing processes, dependencies, constraints and acceptance criteria.
• Assess the current environment and risks; design the target solution across applications, data, integration, infrastructure and cloud or hybrid services. Compare options against business value, risk, delivery effort and operating cost.
• Design and deliver SIEM, IAM/IDM and PAM integrations, including interfaces, data flows, access controls and supporting processes. Install and configure services, or guide engineers through implementation and resolve design issues.
• Translate security assessments into proportionate controls, process improvements and remediation plans. Work with governance, risk and compliance teams to define ownership, evidence and audit requirements.
• Coordinate security, infrastructure, application, operations and audit stakeholders; manage technical dependencies, delivery risks and workstreams within Agile or Waterfall projects.
• Define test strategy, hardening requirements, security and integration tests, and acceptance criteria. Review the implemented solution against the approved design and record changes and residual risks.
• Prepare operational monitoring, incident response, change and patch management, backup and disaster recovery arrangements. Deliver training, knowledge transfer, handover and hypercare through stabilization.
• Measure delivery and operational outcomes using agreed KPIs, including log source coverage, detection coverage, identity lifecycle performance and privileged account onboarding. At senior level, mentor colleagues and lead a workstream.

Typical deliverables

• Security and integration assessment, requirements catalogue and risk and remediation register.
• High level and low level designs (HLD/LLD), architecture diagrams, integration specifications, interface contracts and data flow maps.
• Architecture decision records, implementation roadmap and migration, cutover and rollback plans.
• SIEM detection use cases, IAM role and lifecycle models, PAM onboarding standards, and test plans with acceptance criteria.
• Runbooks, operating model, training materials, support ownership and an operational handover package.

Required qualifications to be successful in this role:

Experience and core security domains

• Medior: typically 3+ years in security architecture, security engineering or enterprise integration. Senior: typically 5+ years, with evidence of delivery ownership and technical leadership. Experience may come from any sector.
• Infrastructure: practical understanding of networking, Windows and Linux, Active Directory, Microsoft Entra ID, and cloud and hybrid environments. Target 3-5 years of relevant infrastructure experience.
• SIEM: log onboarding, parsing, normalization, correlation, detection use cases, tuning, alerting and reporting; integration with SOAR and ITSM. Understand sources such as EDR, firewalls, IDS/IPS, proxy, server, application and cloud audit logs.
• IAM/IDM: identity lifecycle, provisioning and deprovisioning, SSO, MFA, federation using SAML/OIDC, RBAC/ABAC and access governance. Understand integration with HR systems, directory services, enterprise applications and SaaS.
• PAM: credential vaulting and rotation, session management and recording, approval workflows, just in time and just enough access, and onboarding servers, network devices, databases and application accounts.
• Target 3-5 years of relevant experience in SIEM, IAM/IDM and PAM, with practical installation and configuration capability in at least one domain. Target 3-5 years in GRC, risk management and the ISO 27000 and ISO 31000 families; apply controls and process analysis to delivery. General solution architecture requirements
• Translate business capabilities and functional requirements into a coherent solution design. Define measurable nonfunctional requirements for availability, performance, scalability, resilience, security, privacy, maintainability and supportability.
• Design application boundaries, data models and flows, integration patterns and interfaces. Select suitable APIs, connectors, syslog, agents and event streaming; account for authentication, authorization, errors and dependencies.
• Evaluate on premises, cloud, hybrid, commercial and custom options. Explain technology selection and build versus buy decisions, including licensing, total cost of ownership, vendor constraints and lifecycle implications.
• Produce clear architecture diagrams, HLD/LLD and decision records. Maintain traceability from requirements to design, implementation and acceptance; align with enterprise standards and architecture governance.
• Plan incremental implementation, migration, cutover and rollback. Validate critical assumptions with prototypes or proofs of concept; review designs and guide delivery teams through technical tradeoffs.
• Design an operating model covering observability, service levels, incident response, change management, patching, backup and disaster recovery, with clear ownership and support handover.

Additional requirements and advantages Czech and English are required. A formal degree is not required. Strong stakeholder communication, facilitation and documentation skills are essential. Designing and performing security or audit controls, and familiarity with NIST, CIS Controls and ITIL, are advantages. Useful platform experience includes Microsoft Sentinel, Splunk, QRadar or Elastic; SailPoint, ForgeRock, Keycloak or Microsoft Entra ID; and CyberArk, BeyondTrust or Delinea. SOAR and ITSM integrations, PowerShell or Python automation, and experience in regulated sectors are advantages.

What we offer

· Share Purchase Plan · CGI’s My Assistance Program · Compensation for long term sickness up to 30 days · Interest-free company loan · Referral bonus · Lunch vouchers – 140CZK · Group life insurance · Flu and tick vaccination · MultiSport card · Cafeteria Benefit System – 900CZK monthly · Hybrid Working Model & Flexible working hours · 5 weeks of vacation + 3 sick days · Birthday Leave and CSR day And many more…

LI-PMOL

Skills

• Czech
• English
• IDMS
• Infrastructure
• ISO 27005 Risk Manager
• ISO 27032 Lead Cybersec. Mgr
• Presentation skills
• Risk management
• Security Architecture
• SIEM
• Solutions Architecture

What you can expect from us:

• Together, as owners, let’s turn meaningful insights into action.

• Life at CGI is rooted in ownership, teamwork, respect and belonging. Here, you’ll reach your full potential because…

• You are invited to be an owner from day 1 as we work together to bring our Dream to life. That’s why we call ourselves CGI Partners rather than employees. We benefit from our collective success and actively shape our company’s strategy and direction.

• Your work creates value. You’ll develop innovative solutions and build relationships with teammates and clients while accessing global capabilities to scale your ideas, embrace new opportunities, and benefit from expansive industry and technology expertise.

• You’ll shape your career by joining a company built to grow and last. You’ll be supported by leaders who care about your health and well-being and provide you with opportunities to deepen your skills and broaden your horizons.

• That same commitment to fairness extends to how we use technology. To support our recruitment team, AI tools may be used to help assess applications though they never replace human judgement. All hiring decisions remain entirely in the hands of our recruitment professionals.

• Come join our team—one of the largest IT and business consulting services firms in the world.

• Have you been referred by a CGI Partner for this position?

• Yes

• No

• CGI Partner’s email (@cgi.com)*

• First Name

• Last Name

• I agree to allow CGI to contact the CGI Partner who referred me to obtain additional information about my application and confirm my referral.*

• This field is required.