Director, Information Security Architect

Job Summary

The Director, Information Security Architect is responsible for providing leadership through definition and communication of security control requirements for OAPI/OPDC solutions and services in line with industry frameworks and the company's risk appetite. This role exhibits and continually develops expertise within the information and cybersecurity domains, supports the CISO in strategy development, and develops and maintains a roadmap for information security capabilities, technologies and/or service(s). The role requires excellent organizational, communication and collaboration skills and the ability to work on multiple efforts across IT technology and service disciplines.

Job Description

The Director, Information Security Architect will collaborate with Business and IT functional leaders, engineers, industry experts and vendors to identify, qualify, and drive the adoption of security technology and service solutions that enable strategic goals. The Director will coordinate across various compliance functions, IT, and shared services groups to successfully architect, define, and enable new capabilities for Otsuka and our affiliates. The Information Security Architect's core responsibilities include:

• Design and drive roadmaps for core security capabilities, in support of strategy, across the full spectrum of security domains, including network and cloud security, product and application security, identity and access management, data protection, as well as tools support for Security Operations and Cybersecurity Governance, Risk & Compliance (Cyber GRC).
• Lead the collaborative development of Information Security architecture, working with information security, compliance stakeholders (e.g., privacy, compliance, quality) and IT teams to ensure end-to-end protection and compliance with industry standards like NIST CSF and 800-53.
• Report to CISO and senior leadership on the effectiveness of the cybersecurity architecture and provide strategic recommendations to improve the security posture.
• Champion security-by-design, partnering closely with privacy, quality, legal, infrastructure, and business IT teams to ensure that secure practices are standardized and built into OPAI/OPDC's technology lifecycle, elevating both customer trust and internal efficiency.
• Establish, publish and communicate security control standards and guidance across technologies (e.g., endpoints, business applications, hosting and infrastructure) in line with risk posture.
• Play a key leadership role in company-wide information security governance, influencing initiatives around data protection and governance, cloud security, IAM, secure AI usage, and compliance with regulatory and risk standards.
• Provide architectural expertise, direction, and assistance to across the organization to address information security issues and facilitate the delivery of solutions that meet business objectives in a timely and cost-effective manner.
• Collaborate deeply with peers in Security Operations and Cybersecurity GRC, taking a holistic approach to managing and reducing cyber risk across the organization.
• Lead contract negotiations with cybersecurity vendors, ensuring favorable terms, SLAs, and compliance with organizational security policies.
• Lead POV initiatives for new cybersecurity tools and technologies, conducting thorough evaluations and testing to ensure their effectiveness and alignment with organizational needs.
• Continuously evaluate and enhance security systems and technologies, staying current with the latest cybersecurity trends, threats, and best practices.

Qualifications/ Required

Knowledge/ Experience and Skills:

• 10+ years of experience in cybersecurity engineering or architecture.
• 5+ years of experience in development and management of technical security control frameworks.
• 5+ years of experience in securing cloud environments (e.g., AWS, M365, Oracle, Azure) and 3+ years in M365 and AWS.
• Extensive knowledge of security solutions and best practices across the technology landscape (network, application, data and endpoint).
• Expert understanding of risk management, compliance, and governance frameworks related to cybersecurity.
• Experience in Identity and Access Management, including both traditional IAM implementations as well as SailPoint, Entra and AWS IAM management.
• Strong experience leading product security including threat modeling, secure SDLC, and security scanning technologies / vulnerability management.
• Hands-on experience leading Proof of Concept (POC) initiatives for cybersecurity technologies, with the ability to evaluate, test, and provide recommendations for new tools and systems.
• Experience with vendor management, including evaluating, selecting, and managing rela