Enterprise Security Architect

Clorox is the place that's committed to growth - for our people and our brands. Guided by our purpose and values, and with people at the center of everything we do, we believe every one of us can make a positive impact on consumers, communities, and teammates. Join our team. #CloroxIsThePlace

Your role at Clorox:

We are seeking a highly skilled and motivated Enterprise Security Architect to join our team. In this role, you will be responsible for planning and designing security solutions that align with business objectives and comply with applicable regulatory requirements and our organization's policies. As a Security Architect, you will collaborate with cross-functional teams to assess risks, identify vulnerabilities, and recommend effective security controls and mitigation strategies. Your contributions will play a vital role in safeguarding our organization's sensitive data and maintaining a robust security posture in an ever-evolving cloud landscape.

In this role, you will:

• Develop and maintain a security architecture process that enables the enterprise to develop and implement security solutions and capabilities that are clearly aligned with business, technology, and threat drivers

• Develop and maintain security architecture artifacts (e.g., models, templates, standards, and procedures) that can be used to leverage security capabilities in projects and operations

• Support the planning and development of security roadmaps based on sound enterprise architecture practices

• Perform review of IT infrastructure and other reference architectures for security best practices and recommend changes to enhance security and reduce risks, where applicable

• Perform review of security configurations and access to security infrastructure tools, including firewalls, IPSs, WAFs and anti-malware/endpoint protection systems

• Evaluate new services, vendors, applications, and security tools, among other items, from a technical perspective, and to translate the risk characteristics of these activities and functions into enterprise risk terms

• Determine baseline security configuration standards for operating systems (e.g., OS hardening), network segmentation and identity and access management (IAM)

• Develop standards and practices for data encryption and tokenization in the organization, based on the organization's data classification criteria

• Draft security policies and standards to be reviewed and approved management and formally authorized by the Chief Information Security Officer (CISO)

• Evaluate the statements of work (SOWs) to ensure that adequate security protections are in place. Assess the providers' SSAE 16 SOC 1 and SOC 2 audit reports (or alternative sources) for security-related deficiencies and required "user controls"

• Develop and maintain a security architecture process that enables the enterprise to develop and implement security solutions and capabilities that are clearly aligned with business, technology, and threat drivers

• Develop and maintain security architecture artifacts (e.g., models, templates, standards, and procedures) that can be used to leverage security capabilities in projects and operations

• Support the planning and development of security roadmaps based on sound enterprise architecture practices

• Perform review of IT infrastructure and other reference architectures for security best practices and recommend changes to enhance security and reduce risks, where applicable

• Perform review of security configurations and access to security infrastructure tools, including firewalls, IPSs, WAFs and anti-malware/endpoint protection systems

• Evaluate new services, vendors, applications, and security tools, among other items, from a technical perspective, and to translate the risk characteristics of these activities and functions into enterprise risk terms

• Determine baseline security configuration standards for operating systems (e.g., OS hardening), network segmentation and identity and access management (IAM)

• Develop standards and practices for data encryption and tokenization in the organization, based on the organization's data classification criteria

• Draft security policies and standards to be reviewed and approved management and formally authorized by the Chief Information Security Officer (CISO)

• Evaluate the statements of work (SOWs) to ensure that adequate security protections are in place. Assess the providers' SSAE 16 SOC 1 and SOC 2 audit reports (or alternative sources) for security-related deficiencies and required "user controls"

What we look for:

• 5 plus years as an Enterprise Security Architect and/or Systems Engineer; With an additional 2 plus years in designing cloud frameworks, implementing cloud security, or

• Experience in large scale enterprise projects from ideation to finished production product

• 2 plus years of experience doing application and/or infrastructure solution architecture

• 2 plus years of experience building cloud architecture within all Cloud Service Providers or equivalent products and services

• 2 plus years of hands-on experience migrating solutions to the cloud and designing DevOps operational processes, deployment checklists, etc.is desired

• Bachelor's degree in Computer Science, Engineering, technology or similar field is desired

• Security certification(s) preferred: CISSP, CISM

• Experience working with CIS benchmarks

• Demonstrate understanding of Infrastructure as Code, Automation, and Orchestration within all Cloud Service Providers

• Demonstrate experience in deploying web and service-based applications in Windows/Linux environments

• Demonstrate experience in deploying data lakes, data transforms and data analytics in all Cloud Service Providers

• Demonstrate experience and knowledge involving the development of multi-tier and cross-platform architecture plans to include enterprise workflows, and distributed intranet/internet architecture

• A background in general security practices such as identity and access management (IAM), encryption, multi-factor authentication, security information and event management (SIEM), network security, application security, server security and supporting technologies

• A working knowledge of all Cloud Service Provider security best practices and capabilities

• A background in Virtualization Security (Hypervisors, Virtual Machines, etc…)

• Knowledge and experience across IT infrastructure with security frameworks and standards such as ISO 27001, NISTCSF, and other relevant security-related regulations

• Demonstrable knowledge of Application Security tools and Frameworks (i.e. OWASP) is desired

• Security KPIs and Metrics for effectively communicating current state Cloud Security program is desired

• Managing Security roadmaps is desired

#LI-HYBRID

Workplace type:

We seek out and celebrate diverse backgrounds and experiences. We're looking for fresh perspectives, a desire to bring your best, and a non-stop drive to keep growing and learning.

At Clorox, we have a Culture of Inclusion. We believe our values-based culture connects to our purpose and helps our people be the best versions of themselves, professionally and personally. This means building a workplace where every person can feel respected, valued, and fully able to participate in our Clorox community. Learn more about our I&D program & initiatives here.

[U.S.]Additional Information:

At Clorox, we champion people to be well and thrive, starting with our own people. To help make this possible, we offer comprehensive, competitive benefits that prioritize all aspects of wellbeing and provide flexibility for our teammates' unique needs. This includes robust health plans, a market-leading 401(k) program with a company match, flexible time off benefits (including half-day summer Fridays depending on location), inclusive fertility/adoption benefits, and more.

We are committed to fair and equitable pay and are transparent with current and future teammates about our full salary ranges. We use broad salary ranges that reflect the competitive market for similar jobs, provide sufficient opportunity for growth as you gain experience and expand responsibilities, while also allowing for differentiation based on performance. Based on the breadth of our ranges, most new hires will start at Clorox in the first half of the applicable range. Your starting pay will depend on job-related factors, including relevant skills, knowledge, experience and location. The applicable salary range for every role in the U.S. is based on your work location and is aligned to one of three zones according to the cost of labor in your area.

-Zone A: $121,900 - $240,100

-Zone B: $111,700 - $220,100

-Zone C: $101,600 - $200,100

All ranges are subject to change in the future. Your recruiter can share more about the specific salary range for your location during the hiring process.

This job is also eligible for participation in Clorox's incentive plans, subject to the terms of the applicable plan documents and policies.

Please apply directly to our job postings and do not submit your resume to any person via text message. Clorox does not conduct text-based interviews and encourages you to be cautious of anyone posing as a Clorox recruiter via unsolicited texts during these uncertain times.

To all recruitment agencies: Clorox (and its brand families) does not accept agency resumes. Please do not forward resumes to Clorox employees, including any members of our leadership team. Clorox is not responsible for any fees related to unsolicited resumes.