Security Architect - Banamex Banamex is transforming-and we're doing it from the inside out.
We're rebuilding one of Mexico's most iconic banks into a modern, secure, cloud-first financial platform that moves at fintech speed but with the scale and trust of a national institution.
As our Security Architect , you'll report directly to the CTO and become the architectural backbone of that transformation. Your mission: design the next-generation security fabric that protects millions of customers while empowering engineers to deliver faster, safer, and smarter.
You won't be maintaining controls-you'll be defining what secure banking looks like for the next decade . From Zero Trust architecture and DevSecOps pipelines to SPEI/CoDi payments, cloud workloads, and digital identity , you'll embed resilience, privacy, and compliance into every product we launch.
This is a role for someone who wants to build patterns that outlive them , influence architectural decisions at the highest level, and see their work ripple across the entire Mexican financial ecosystem.
If you want to make impact-not noise-this is where it happens.
What you'll own Target Security Architecture: Define and evolve reference architectures, control patterns, and guardrails for on-prem, cloud (AWS/Azure/GCP), and hybrid environments.
Design Authority: Lead architecture reviews and formal threat modeling (STRIDE/LINDDUN); document risk-based decisions that stand up to audit.
Zero-Trust & Identity: Drive identity-centric designs (OIDC/OAuth2/SAML, MFA, PAM), workload identity, micro-segmentation, and continuous verification.
Data Security: Standardize encryption at rest/in transit, KMS/HSM usage, tokenization, data classification, DLP, and secrets management.
Cloud & Container Security: Patterns for Kubernetes, serverless, and IaC (Terraform); adopt policy-as-code (OPA/Conftest), image signing, and runtime protections.




DevSecOps Enablement: Embed SAST/DAST/IAST/SCA and IaC scanning into CI/CD; create reusable modules and golden paths developers love.
Payments & Channels: Architect controls for SPEI/CoDi rails, card issuing/acquiring, mobile/web apps, and open banking APIs.
Third-Party & SaaS: Intake standards, vendor architecture reviews, compensating controls, and continuous monitoring.
Detection & Response Architecture: Telemetry standards and use cases for SIEM/SOAR/EDR/NDR aligned to MITRE ATT&CK.;
Compliance by Design: Map controls and evidence to CNBV/Bank of Mexico expectations, PCI DSS, ISO 27001, SOX/GLBA equivalents, and FFIEC-aligned practices.
Executive Storytelling: Translate technical risk into business impact for the CTO, Architecture Board, and senior leadership.
What makes this opportunity special Direct impact at the top: Report to the CTO and shape bank-wide technology strategy.
National scale: Your patterns secure mission-critical platforms used across Mexico.
Modernization with purpose: Move fast with strong guardrails-security that accelerates delivery, not slows it.
Growth & visibility: Present to executive forums, mentor engineers, and build the bank's security pattern library.
What you've done (Required) 10+ years in security engineering/architecture; 3+ designing enterprise systems in regulated industries (banking/fintech preferred).
Owned reference architectures and security patterns across cloud + on-prem.
Depth in identity (OAuth2/OIDC/SAML), IAM/PAM, Zero Trust, and secrets management.
Practical cryptography (TLS/mTLS, key mgmt, HSM/KMS), data protection, and classification.
DevSecOps experience integrating SAST/DAST/SCA, container/K8s security, and IaC scanning into pipelines.
Designed logging/telemetry for SIEM/SOAR with clear detection use cases.
Proven track translating regulatory requirements into automated,

#J-18808-Ljbffr

📌 It Cloud Security Jr Manager (Xico)
🏢 Aeromexico
📍 Xico