At CI&T, we help large enterprises transform the potential of AI into real business impact with AI Deployment, AI-native execution, and tech-integrated business solutions.
With 30 years of experience in technological transformation, we accelerate innovation with expertise in Agentic SDLC, Application modernization, Data & AI, Martech and Business strategy.
We are 8,000 CI&Ters across more than 25 countries, collaborating to build solutions with real impact. AI is already part of how we work, evolve, and innovate every day.
We accept candidates from Brazil and Colombia.
Work model: 100% Remote
Working hours: Business hours, aligned with US-based stakeholders
The Senior Cybersecurity Architect & Operations Specialist will lead the evolution, optimization, and operational effectiveness of cybersecurity services for a US-based organization. This role combines security architecture, security operations leadership, incident response, threat intelligence, and third-party service management.
Working closely with executive stakeholders and cross-functional technical teams, this professional will serve as a senior technical leader, ensuring that security technologies, service providers, and operational processes work together effectively to protect the organization's environment, manage cyber risks, and meet applicable regulatory and compliance requirements.
This position reports directly to the organization's Head of Security and works in close partnership with other cybersecurity leaders across the security program.
This position requires fluent English, as you will interact daily with US-based stakeholders and participate in technical discussions and executive-level meetings.
Cybersecurity Operations Leadership & Optimization: Lead the continuous improvement of the cybersecurity operations function, ensuring that security monitoring, detection, investigation, escalation, and response capabilities are effective, integrated, and aligned with business priorities. Identify operational gaps, improve processes, and drive initiatives that strengthen the organization's security posture.
Security Architecture & Technology Management: Evaluate and optimize the architecture, configuration, integration, and effectiveness of security technologies and services across the environment. Ensure that security capabilities are properly implemented, monitored, maintained, and continuously improved, maximizing their effectiveness and value.
Third-Party Service Management: Coordinate and oversee external cybersecurity service providers, ensuring clear responsibilities, effective collaboration, service quality, and alignment with operational requirements. Consolidate activities across multiple providers, manage dependencies, monitor performance, and drive accountability for service delivery and continuous improvement.
Security Incident Management & Escalation: Act as the senior escalation point during business hours for significant security alerts, complex investigations, and cybersecurity incidents. Coordinate incident response activities, guide technical investigations, support containment and remediation decisions, and ensure appropriate communication, documentation, and follow-up with relevant stakeholders.
Security Monitoring & Detection Engineering: Oversee the effectiveness of security monitoring and detection capabilities, including SIEM, endpoint security, network security, identity, and cloud security. Drive improvements in log coverage, detection rules, alert prioritization, correlation, and response workflows to reduce false positives, improve visibility, and accelerate incident handling.
Threat Intelligence & Proactive Defense: Lead threat intelligence activities by evaluating emerging threats, relevant threat actors, attack techniques, and vulnerabilities that may affect the organization. Translate intelligence into actionable recommendations, detection improvements, preventive controls, and defensive strategies tailored to the organization's risk profile.
Security Projects & Continuous Improvement: Lead security-related projects, technology implementations, integrations, upgrades, and operational changes. Define priorities, coordinate stakeholders, manage dependencies, and ensure that initiatives deliver measurable improvements to security capabilities and operational maturity.
Executive Communication & Stakeholder Management: Present security posture, operational performance, significant incidents, emerging threats, risks, and improvement initiatives to senior stakeholders. Translate complex technical information into clear business implications, actionable recommendations, and prioritized decisions.
AI-Driven Security Operations: Identify opportunities to leverage AI and automation to improve operational efficiency, accelerate investigations, streamline reporting, reduce repetitive work, and enhance security analysis, while maintaining appropriate security, privacy, and governance controls.
Significant experience in cybersecurity, with a strong background in security architecture, security operations, or a combination of both.
Proven experience leading cybersecurity initiatives, coordinating technical teams, and managing third-party security service providers.
Strong understanding of SOC operating models, including security monitoring, alert triage, investigation, incident escalation, and incident response processes.
Hands-on knowledge of security technologies and their integration, configuration, monitoring, and optimization, particularly SIEM, EDR, network security, and cloud security capabilities.
Experience managing complex security incidents, coordinating investigations, supporting containment and remediation, and communicating findings and recommendations to stakeholders.
Experience with threat intelligence, threat detection, security monitoring improvements, and proactive defense strategies.
Ability to assess security architecture and operational processes, identify gaps, and translate findings into practical technical and organizational improvements.
Experience leading security projects, implementations, integrations, upgrades, and continuous improvement initiatives.
Excellent communication, leadership, analytical, and problem-solving skills, including the ability to make informed decisions under pressure.
Ability to communicate complex technical concepts clearly to both technical teams and executive stakeholders.
Fluent English, including the ability to lead meetings, discuss complex security topics, and deliver executive-level presentations.
Ability to work independently, prioritize competing demands, and collaborate effectively across geographically distributed teams.
Experience with Microsoft Sentinel or other SIEM platforms, EDR solutions, endpoint protection, identity security, network security, VPN, DNS security, and related technologies.
Experience in the healthcare, medical device, or other regulated industries.
Experience supporting US-based organizations and working directly with executive stakeholders.
Familiarity with healthcare-related regulatory and security frameworks, such as HIPAA and HITRUST, as well as NIST Cybersecurity Framework and ISO 27001.
Experience with AWS security services and cloud security architecture.
Understanding of cybersecurity risk management, operational controls, and applicable regulatory and compliance requirements.
Experience improving SOC efficiency through automation, orchestration, and security operations use cases.
Practical experience using AI tools or implementing AI-enabled solutions to improve cybersecurity operations, threat analysis, incident investigation, or reporting.
Relevant certifications such as CISSP, CISM, CCSP, GIAC certifications, or equivalent credentials.
A bachelor's degree in Computer Science, Information Security, or a related field.