Global Cybersecurity Senior Manager - Architecture

Key Responsibilities

• Define and maintain data security architecture: data loss prevention (DLP), data classification and tagging enforcement, encryption, and data privacy governance interfaces.
• Own architectural requirements for Microsoft Purview enforcement: sensitivity labeling, auto-labeling policy design, DLP policy architecture across endpoints, email, and cloud services.
• Define data classification enforcement architecture in alignment with the Global Data Classification Policy and Global Data Protection Policy, ensuring controls scale with data sensitivity.
• Own encryption and key management architecture requirements for infrastructure-managed data, including interfaces to secrets management and enterprise key management platforms including crypto-agility and post-quantum cryptography (PQC) migration readiness for infrastructure-managed data and key material.
• Define secure data access patterns for infrastructure-managed data stores and application interfaces, preventing unauthorized access, exposure, or tampering.
• Architect DLP coverage for emerging data egress channels, including AI-enabled tooling and agentic workflows, in coordination with Enterprise Security Architecture.
• Author and maintain the security standards, reference architectures, and control requirements that govern the Secure Data domain, mapped to CSF-10 (Data Protection) and ZTMM maturity targets.
• Conduct security architecture reviews for secure data initiatives; issue dispositions, conditions, and architectural decision records traceable to ISRM governance.
• Contribute domain expertise to ZTMM maturity assessments, control gap analyses, and the security architecture roadmap.
• Serve as the dedicated architecture counterpart to the Secure Data Engineering Squad, validating feasibility and effectiveness of security controls through implementation without assuming delivery ownership.
• Define logging, telemetry, and monitoring requirements (CSF-12) for secure data services in partnership with Security Operations, which owns SIEM, detection engineering, and continuous monitoring
• What You'll Bring
• Bachelor’s degree in a relevant field or equivalent practical experience.
• 6–10 years in security architecture, security engineering, or infrastructure security with demonstrated architecture responsibility.
• Experience operating in large, audit-sensitive, or regulated enterprise environments with formal governance and exception processes.
• Strong understanding of zero trust architecture (NIST SP 800-207, CISA ZTMM), enterprise control frameworks, and hybrid cloud environments (Azure, AWS, GCP).
• Deep hands-on architecture experience with Microsoft Purview (Information Protection, DLP), enterprise data classification programs, and encryption architecture.
• Working knowledge of key management and secrets management platforms (e.g., HashiCorp Vault, cloud-native KMS/HSM), BYOK patterns, and cryptographic standards lifecycle.
• Familiarity with insider risk, data egress monitoring, and DLP enforcement across endpoint, network, and SaaS channels.

Preferred Qualifications

• Professional certifications such as CISSP, SABSA, or relevant cloud security certifications.
• Who You'll Work With
• You will join the Infrastructure Security Architecture team within Information Security Risk Management (ISRM), serving as the dedicated security architecture partner for BCG’s Secure Data Engineering Squad. In this role, you will own the governance and technical architecture requirements that protect data across loss prevention, classification enforcement, encryption, and secrets management.
• You will collaborate closely with engineering, cloud, identity, infrastructure, and security teams across BCG’s global technology organization to ensure data security controls are consistently designed, implemented, and governed. You will also partner with Security Operations, Risk Management, and architecture peers to advance Zero Trust Data pillar maturity and support enterprise-wide cybersecurity initiatives.
• Working within a highly collaborative, matrixed environment, you will influence technical direction, build alignment on architectural decisions, and help teams deliver secure, scalable solutions that balance business objectives, operational effectiveness, and risk management.
• Additional info
• At BCG, our people and relationships are at the heart of everything we do. We believe that in-person collaboration plays an important role in our culture, mentorship, and professional development.
• For this role, you will generally be expected to work from a BCG office or in person with clients on a regular basis (typically around 50% of working time), depending on business needs and in line with local policies and practices.
• We aim to provide a dynamic and collaborative environment that fosters connection and teamwork.

You’re Good At