Principal Cybersecurity Architect - Lab & Customer Infrastructure

Veteran Firm Seeking a Principal Cybersecurity Architect - Lab and Customer Infrastructure for a Remote Assignment in United States

My name is Stephen Hrutka. I lead a Veteran-Owned management consulting firm in Washington, DC. We specialize in Technical and Cleared Recruiting for the Department of Defense (DoD), the Intelligence Community (IC), and other advanced defense agencies.

At HRUCKUS, we support fellow Veteran-Owned businesses by helping them recruit for positions across organizations such as the VA, SBA, HHS, DARPA, and other leading-edge R&D-focused defense agencies.

We seek to fill a Principal Cybersecurity Architect - Lab and Customer Infrastructure role in Remote, US

The ideal candidate is a Remote, US resident with deep network security and multi-tenant architecture experience, and recent hands-on expertise in identity security and Zero Trust architecture.

If you’re interested, I'll gladly provide more details about the role and further discuss your qualifications.

Thanks,

Stephen M Hrutka

Principal Consultant

www.hruckus.com

Executive Summary: HRUCKUS is looking for an experienced Principal Cybersecurity Architect - Lab and Customer Infrastructure to design and govern security for complex, customer-facing lab and infrastructure environments requiring strict tenant isolation, secure external connectivity, and strong identity controls.

Position Description: This is a hands-on architecture role requiring the architect to work directly with security and infrastructure engineers, design detailed technical controls, resolve architectural challenges in real time, and communicate recommendations effectively to varied audiences ranging from developers to executives.

Position Responsibilities:

• Design security architecture for multi-tenant customer lab environments
• Ensure strict isolation between customer environments
• Develop network segmentation and micro-segmentation architectures
• Establish firewall zoning and inter-VLAN routing controls
• Apply Zero Trust principles between tenant environments
• Develop security standards for provisioning new customer environments
• Define validation requirements before environments become operational
• Establish secure decommissioning processes that eliminate residual data and configurations
• Lead tenant-isolation validation through penetration testing, traffic analysis, and configuration audits
• Architect secure remote customer connectivity
• Evaluate and design ZTNA, IPSec SSL VPN, MPLS, and dedicated connectivity solutions
• Define external-party identity verification and onboarding requirements
• Establish MFA, least-privilege, access-scoping, and time-limited access controls
• Design secure remote-access gateways with comprehensive session logging
• Integrate access activity into security monitoring platforms
• Design security controls for workforce and non-human identities
• Establish secure approaches for service principals, managed identities, secrets, certificates, and privileged accounts
• Design phishing-resistant authentication and device-trust controls
• Work directly with identity, security, infrastructure, and network engineers to develop implementable architecture
• Translate complex security concepts for executives, developers, engineers, and nontechnical stakeholders

Required Qualifications:

• Principal-level cybersecurity architecture experience
• Recent hands-on identity security architecture experience
• Strong understanding of workforce and non-human identity security
• Experience securing service accounts, service principals, managed identities, and machine identities
• Strong knowledge of secrets management and PAM
• Deep understanding of phishing-resistant MFA
• Experience with certificate-based authentication
• Experience designing device-trust and device-compliance controls
• Strong Zero Trust architecture experience
• Deep network security and segmentation knowledge
• Experience designing secure multi-tenant environments
• Experience with VLANs, firewall zoning, micro-segmentation, and routing controls
• Experience architecting secure external connectivity
• Strong knowledge of ZTNA, VPN technologies, and least-privilege remote access
• Experience across multiple platforms and authentication approaches (beyond solely Microsoft 365 or Entra ID)
• Ability to work directly with senior engineers and technical SMEs
• Strong consulting and stakeholder communication skills
• Deep experience designing secure infrastructure environments using: Network segmentation, Micro-segmentation, VLANs, Firewall zoning, Inter-VLAN routing controls, Zero Trust segmentation, Tenant isolation, Secure remote connectivity

Desired Qualifications:

• Deep knowledge and ability to design technical controls around FIDO2, passkeys, and hardware-backed authentication concepts
• Ability to explain and design technical controls for conditional access concepts
• Strong capability to challenge and defend technical decisions with senior engineers while remaining collaborative

Details:

Job Title: Principal Cybersecurity Architect - Lab and Customer Infrastructure

Location: Remote, US

Salary Range: $85 to $100 per hour W-2