Director, Security Architecture & Engineering

ABOUT THE JOB

The ACLU seeks applicants for the full-time position of Director of Security Architecture & Engineering in the Information Security Department of the ACLU’s National office in New York, NY. This is a hybrid role that has in-office requirements of two (2) days per week or eight (8) days per month. 

This leadership position reports directly to the Chief Information Security Officer (CISO) and is responsible for driving enterprise security architecture and engineering strategy across the ACLU’s national and affiliate environments.

The Director serves as the principal architect for reducing organizational attack surface, minimizing the risk of lateral movement, and embedding enforceable, risk-aligned security design standards into the ACLU’s environment. This role will lead enterprise-wide efforts to operationalize Secure by Design, strengthen identity architecture and segmentation, and ensure the consistent enforcement of core security controls.

The Director will translate policy and risk into technical designs, baseline controls, and sustainable engineering practices—working in close partnership with Technology and IT teams, platform teams, affiliates, and key National stakeholders, including Legal, National Political Advocacy (NPAD), and Development.

The Director will lead a highly collaborative and technically skilled team of three direct reports, each of whom manages a core domain of the security architecture program.

WHAT YOU'LL DO 

Reporting to the Chief Information Security Officer (CISO), the Director of Security Architecture & Engineering will play a strategic and operational leadership role in advancing the ACLU’s security posture. This includes translating high-level security policy into actionable design guidance, embedding security requirements into enterprise architecture, and holding cross-functional teams accountable for consistent implementation.

 

YOUR DAY TO DAY

• Lead the development and execution of the ACLU’s Secure by Design and Secure by Default strategy; translate policy and risk priorities into reference architectures, technical baselines, and automated guardrails.
• Establish and chair the Control Design Review Board (CDRB) to govern architectural decisions involving identity boundaries, network segmentation, data egress, privileged access, third-party integrations, and other critical control points.
• Define, publish, and maintain enterprise reference architectures covering cloud services (Microsoft 365, AWS), identity zones, network segmentation tiers, privileged access models, SaaS security, and service-to-service authentication standards.
• Drive the secure implementation of ZTNA/SASE, configuration drift detection, phishing protection, and secure baseline management across cloud, endpoint, and infrastructure systems.
• Oversee the development and enforcement of modern identity and access management models.
• Design and implement an enterprise segmentation strategy, incorporating both macro- and micro-segmentation approaches to reduce lateral movement risk and isolate sensitive business processes and data environments.
• Oversee the organization’s Attack Surface Management (ASM) capabilities by formalizing asset inventory, exposure tracking, remediation prioritization, and SLA adherence across all relevant environments.
• Advance the ACLU’s Insider Threat and Data Protection programs.
• Provide executive-level decision-making on risk tradeoffs, technical exceptions, and compensating control design, ensuring a clear path to resolution with expiration timelines and audit visibility.
• Partner with the GRC to align technical controls with policy, regulatory requirements, vendor standards, and internal audit frameworks.

 

FUTURE ACLU'ERS WILL 

• Be committed to advancing the mission of the ACLU
• Center and embed the principles of equity, inclusion and belonging in their work by demonstrating commitment to diversity with an approach that respects and values multiple perspectives
• Be committed to work collaboratively and respectfully toward resolving obstacles and conflicts

WHAT YOU'LL BRING

• Extensive experience in progressive cybersecurity, with equivocal expertise in a technical architecture, engineering leadership, or hands-on security infrastructure role.
• Deep expertise in security architecture across hybrid enterprise environments, including identity and access management, network segmentation, endpoint security, cloud/SaaS hardening, and exposure management