Senior Security Architect Job in San Francisco, California US

Senior Security Architect

Empowering healthcare starts with you. At McKesson, whether you work in HR or marketing, finance or public affairs, you're making a difference. You'll spark a chain reaction that results in millions of people getting more from their healthcare. As the nation's leading healthcare services company, we touch virtually every aspect of healthcare. We empower our customers by delivering vital supplies and solutions. And we empower our employees through a supportive environment where opportunity and responsibility grow. Our exceptional leadership team provides the vision and strategy to advance healthcare, so you can feel confident in our direction and your future. At McKesson, we believe we can empower healthcare. And it all starts with you. Position Description ** This position can be filled in either San Francisco, California or Alpharetta, Georgia The Information Security Architecture and Services (ISAS) function is responsible for the development of technical security standards, requirements and implementation of appropriate technology architectures to mitigate risks to McKesson and customer information assets, specifically: - Develop the Information Security Technical Architecture and related deployment plans. - Provide project (expert level) advisory and consulting services for various constituents on technical related information security matters. Build and manage the deployment of technical solutions, standards, processes and the implementation of supporting tools to support the mitigation of technical threats ¿ - Develop and maintain a threat models working with business units, senior IT risk management leaders, and technical subject matter specialists. Specific emphasis will be given to demonstrated skills with product security and/or secure application development and testing experience. - Establish a program to develop and maintain solution architectures to mitigate identified threats based on a supporting prioritization process. - Establish Security referential architectures and strategies for service areas such as Encryption and Key Management, Identity and Access Management, Cloud Computing, Virtualization, Infrastructure Security (Network, Unix, Wintel, Wifi, RDBMS), Application Security (Secure Web Development), Secure Data Management, and Data Loss Prevention. Required to demonstrate broad knowledge of the above and similar emerging IT topics, with demonstrated deep expertise in one or more. - Document current security architecture, research best practice, conduct trend analysis, and identify gaps in developing future-state security architecture - Develop technical standards for the corporation and provide subject matter expert level advisory services regarding commercially accepted `best practices¿. Provide security architecture and consulting services with business units and IT organizations, specifically: - Strategic projects / initiatives, both customer facing and internally focused - New areas of business and/or emerging technologies - Acquisitions and divestitures - Advice as part of their customer facing product and service development efforts - Advice on internal development projects - Services to perform more detailed risk assessments and security reviews as needed - Support in responding to customer requests related to IT risk management and security - Work closely with BU IT Risk Management leaders and business management to understand their strategic priorities and concerns, while being able to interact with technical specialists on a variety of technical topics. - Build/leverage the informal network of security and risk professionals in the Business Units and IT organizations. - Forensics and investigation experience is regarded as a plus. Subject Matter Expert - Demonstrate expert level knowledge and track record with information security services and related technologies. - Technical knowledge and detailed understanding of emerging IT trends, e.g., SaaS, cloud computing, SOA, virtualization, web technologies, inter-networking trends. - Demonstrated experience with product security, secure SDLC and/or QA practices and technologies, a definite plus. Additional Knowledge Skills Minimum 10+ years technical security architecture, and/or specialist security, and/or network, and/or infrastructure, and/or application security experience Professional Services and/or research experience is a plus Application development experience a definite plus. Demonstrated experience with web technologies a definite plus. Documentation experience with Word, PowerPoint, Visio and SharePoint Knowledge of the healthcare and software development industries is a plus. Experience working with organizations with SaaS business models advantageous Experience working with organizations with significant virtualized data centre footprints is advantageous Experience working with regulated industries, e.g., financial services is advantageious Additional Knowledge Skills - Strong interpersonal skills to build/ maintain ongoing business relationships with technical personnel from any grade level and C-suite. - Able to exercise professional judgment within defined procedures - Experience in Risk Assessment, audit, and IT security assessments - Comprehensive understanding of the IT risk management and security fields - Familiar with compliance regulations and IT and security frameworks and standards - Enterprise Architecture development, and knowledge of TOGAF, Zachman, SABSA, or similar architecture framework Minimum Requirements 6+ years experience in administering security controls in an organization Education 4-year degree in computer science or related field or equivalent experience Graduate degree and/or qualification will be viewed favorably. Physical Requirements General Office Demands Agency Statement No agencies please. The material contained herein is provided for informational purpose only. All open jobs offered by McKesson Corp. on this recruitment system are subject to specific job skill requirements. The job skill requirements, qualifications, and preferred experience are determined by a subsidiary, office or department within the company which is offering the position, and all positions are subject to local prevailing employment laws and restrictions. This would include immigration laws pertaining to work authorization requirements and any other applicable government permissions or compliance. The materials on this site are provided without warranties of any kind, either expressed or implied, including but not limited to warranties regarding the completeness of information contained on this site or in any referenced links. While McKesson Corp. attempts to update this site on a timely basis, the information is effective only as of the time and date of posting. By providing your application to McKesson Corp. you hereby consent to McKesson Corp. obtaining personal information regarding you that is related to the position applied for. You also consent to McKesson Corp. transferring your application details to our recruitment partners for their review and assistance. You also consent to McKesson Corp. keeping your application on file for 6 years. McKesson Corp. is an equal opportunity employer. The information on this site is for information purpose only and is not intended to be relied upon with legal consequence.