Security Architecture Director

What Information Security and Risk contributes to Cardinal Health

Information Technology is vital in developing, delivering, and managing computing and information services effectively. This function anticipates, strategizes, and delivers IT solutions that empower operations and drive business value.

Information Security and Risk is responsible for formulating, implementing, and enforcing robust security controls that safeguard the organization’s technology assets from both intentional and inadvertent threats. This includes developing disaster recovery plans, managing incident responses, assessing vulnerabilities, and conducting risk evaluations.

Job Summary

The Security Architecture Director will spearhead the creation and implementation of security architecture strategies, standards, and designs essential for secure, scalable, and resilient technology across the organization. Reporting directly to the Vice President of Information Security & Risk, this role will serve as a pivotal technical leader, aligning security architecture with business goals, risk management frameworks, and enterprise GTBS strategies.

The role encompasses leading security architecture in areas such as strategy governance, technical standards, solution design, architecture reviews, and optimization of tools. An integral part of this position is to embed security into the development lifecycle, guide tech investments, and ensure security considerations are embedded into architectural strategies from the planning stage through deployment.

Key Responsibilities

Organizational Leadership & Architecture Strategy

Lead the enterprise security architecture strategy in line with cybersecurity, risk management, and business objectives. Establish governance frameworks and processes to support secure design and technology selection across the organization. Collaborate with cybersecurity leadership and technology teams to craft a target-state architecture and a long-term roadmap. Serve as an advisor to leadership regarding priorities in security architecture, associated risks, and investment suggestions. Security Architecture Standards & Governance

Develop, maintain, and enforce comprehensive security architecture standards, including design principles and control requirements. Ensure alignment of standards with regulatory mandates and organizational risk tolerance. Create processes for governance related to the adoption and enforcement of architecture standards globally. Continuously refine standards in response to emerging threats and business dynamics. Security Architecture Review & Validation

Oversee processes dedicated to reviewing architectures for compliance with security standards and risk needs. Identify and address security risks before solutions are implemented. Approve and validate security architecture decisions, handling exceptions as required. Promote consistency and quality across architecture review practices. Cybersecurity Advisory for Development & Design

Offer proactive security guidance during design and development phases to inform risk-based decisions. Partner with application teams to integrate security requirements from the outset of the development process. Support pre-implementation assessments and architecture decisions for new initiatives. Serve as a liaison to convey security requirements effectively to technical and non-technical stakeholders. Security Tooling & Architecture Optimization

Evaluate and optimize the cybersecurity tool landscape for enhanced efficiency and capability. Ensure that tooling aligns with the enterprise security architecture to support risk management. Work with engineering teams to seamlessly integrate tools into the cybersecurity ecosystem. Foster continuous improvement of tooling strategies for increased scalability and innovation. Security Architecture Design & Engineering Enablement

Define reference architectures and reusable design patterns to facilitate secure system development. Guide the implementation of security controls across applications and infrastructure. Assist teams in crafting secure solutions that meet performance and usability requirements. Encourage the adoption of secure design principles within development teams. Capability Mapping & Roadmap Development

Evaluate current and desired security capabilities against business priorities. Create and maintain a phased roadmap for guiding strategic architecture investments. Align architecture efforts with enterprise transformation endeavors and technology advancements. Identify capability gaps and funding needs to support strategic planning. Stakeholder Engagement & Integration

Collaborate extensively with various teams to align security strategy with enterprise goals. Work with business stakeholders to incorporate security into broader technology strategies. Guide projects to ensure cybersecurity requirements meet architectural standards. Facilitate consistent communication and alignment among global cybersecurity teams. Talent Leadership & Capability Development

Build and lead a high-performing security architecture team with diverse expertise. Enhance team skills through coaching, training, and career development pathways. Cultivate a culture of technical excellence and ongoing improvement. Align team skills with the evolving landscape of cybersecurity needs. Qualifications

10+ years of experience in cybersecurity or information security, particularly in enterprise architecture. Extensive knowledge of security architecture frameworks and secure design approaches. Strong familiarity with cybersecurity response frameworks and regulatory standards. Proven experience leading security architecture reviews and guiding secure solution development. Ability to effectively collaborate and influence both technical and business audiences. Exceptional leadership, communication, and analytical skills. Experience managing security architecture or engineering teams. Experience in regulated industries such as finance, healthcare, or aviation. Advanced degrees such as an MBA or MS in Cybersecurity or related fields are highly regarded. Professional certifications such as CISSP or CCSP are preferred. Knowledge of cloud security architecture and DevSecOps practices is advantageous. What to Expect

Lead and manage teams with experienced professionals and front-line supervisors. Coordinate an organizational budget and manage the necessary resources. Design policies and procedures to meet organizational goals. Take part in shaping functional strategies. Your decisions will significantly impact processes, outcomes, and users. Engage with internal and external leaders, including senior management. Convey persuasive messages in sensitive discussions while nurturing positive relationships. Anticipated salary range: $135,400 - $208,100

Bonus eligible: Yes

Benefits: Cardinal Health provides a wide array of benefits to support your health and well-being.

Medical, dental, and vision coverage. Paid time off plan. Health savings account (HSA). 401k savings plan. Access to wages before payday. Flexible spending accounts (FSA). Short- and long-term disability coverage. Work-Life resources. Paid parental leave. Programs promoting healthy lifestyles. Application window anticipated to close: 6/12/26. We encourage interested candidates to apply as soon as possible.

The listed salary range is an estimate, influenced by various factors such as geographical locations, relevant experience, skills, and internal pay equity strategies.

Cardinal Health values a diverse workplace and encourages applications from candidates returning to work, those with disabilities, veterans, and individuals without a college degree.

We embrace a culture of inclusivity, highlighting the importance of diverse perspectives to develop better solutions for our clients while allowing individuals to bring their authentic selves to work every day. Cardinal Health is an Equal Opportunity/Affirmative Action employer.