Sr. Associate, Cybersecurity Architect

About the role

The Sr. Associate, Cybersecurity Architect will design, govern, and continuously improve secure architecture across enterprise platforms, applications, and infrastructure within Santander's regulated financial environment. This role bridges security engineering, enterprise architecture, and compliance, ensuring that security controls are embedded early in the development lifecycle.

Key responsibilities

• Conduct threat modeling, security design reviews, and lead cybersecurity architecture risk assessments (ISARs).
• Define and maintain enterprise security architecture aligned with business strategy for cloud, hybrid, and on‑prem environments.
• Partner with engineering, product, and business teams to embed security controls using a shift‑left approach.
• Architect and oversee encryption strategies for data at rest, in transit, and in use, including PKI, HSM, and certificate lifecycle processes.
• Establish cryptographic key management standards and oversee key custody models.
• Ensure architectural compliance with regulatory and supervisory expectations and support examinations, audits, and control validation activities.

Required profile

• Bachelor’s degree in Computer Science, Engineering, Information Technology Management, or equivalent experience.
• 5+ years of architecture experience in financial services or similarly regulated industries.
• Demonstrated experience operating in a shift‑left security model embedded with development and business teams.
• Strong understanding of regulatory mandates and risk appetite within a high‑control financial environment.

Required skills

• Threat modeling
• Security design reviews
• ISARs (cybersecurity architecture risk assessments)
• Enterprise security architecture
• Cloud, hybrid, and on‑premise security architecture
• Shift‑left security integration
• Encryption strategies (data at rest, in transit, in use)
• PKI architecture and governance
• HSM deployment and management
• Certificate lifecycle management
• Cryptographic key management
• Regulatory compliance frameworks