Security Architect - Banamex Banamex is transforming-and we're doing it from the inside out. We're rebuilding one of Mexico's most iconic banks into a modern, secure, cloud-first financial platform that moves at fintech speed but with the scale and trust of a national institution. As our Security Architect , you'll report directly to the CTO and become the architectural backbone of that transformation. Your mission: design the next-generation security fabric that protects millions of customers while empowering engineers to deliver faster, safer, and smarter. You won't be maintaining controls-you'll be defining what secure banking looks like for the next decade . From Zero Trust architecture and Dev Sec Ops pipelines to SPEI/Co Di payments, cloud workloads, and digital identity , you'll embed resilience, privacy, and compliance into every product we launch. This is a role for someone who wants to build patterns that outlive them , influence architectural decisions at the highest level, and see their work ripple across the entire Mexican financial ecosystem. If you want to make impact-not noise-this is where it happens. What you'll own Target Security Architecture: Define and evolve reference architectures, control patterns, and guardrails for on-prem, cloud (AWS/Azure/GCP), and hybrid environments. Design Authority: Lead architecture reviews and formal threat modeling (STRIDE/LINDDUN); document risk-based decisions that stand up to audit. Zero-Trust & Identity: Drive identity-centric designs (OIDC/OAuth2/SAML, MFA, PAM), workload identity, micro-segmentation, and continuous verification. Data Security: Standardize encryption at rest/in transit, KMS/HSM usage, tokenization, data classification, DLP, and secrets management. Cloud & Container Security: Patterns for Kubernetes, serverless, and Ia C (Terraform); adopt policy-as-code (OPA/Conftest), image signing,



and runtime protections. Dev Sec Ops Enablement: Embed SAST/DAST/IAST/SCA and Ia C scanning into CI/CD; create reusable modules and golden paths developers love. Payments & Channels: Architect controls for SPEI/Co Di rails, card issuing/acquiring, mobile/web apps, and open banking APIs. Third-Party & Saa S: Intake standards, vendor architecture reviews, compensating controls, and continuous monitoring. Detection & Response Architecture: Telemetry standards and use cases for SIEM/SOAR/EDR/NDR aligned to MITRE ATT&CK.; Compliance by Design: Map controls and evidence to CNBV/Bank of Mexico expectations, PCI DSS, ISO 27001, SOX/GLBA equivalents, and FFIEC-aligned practices. Executive Storytelling: Translate technical risk into business impact for the CTO, Architecture Board, and senior leadership. What makes this opportunity special Direct impact at the top: Report to the CTO and shape bank-wide technology strategy. National scale: Your patterns secure mission-critical platforms used across Mexico. Modernization with purpose: Move fast with strong guardrails-security that accelerates delivery, not slows it. Growth & visibility: Present to executive forums, mentor engineers, and build the bank's security pattern library. What you've done (Required) 10+ years in security engineering/architecture; 3+ designing enterprise systems in regulated industries (banking/fintech preferred). Owned reference architectures and security patterns across cloud + on-prem. Depth in identity (OAuth2/OIDC/SAML), IAM/PAM, Zero Trust, and secrets management. Practical cryptography (TLS/m TLS, key mgmt, HSM/KMS), data protection, and classification. Dev Sec Ops experience integrating SAST/DAST/SCA, container/K8s security, and Ia C scanning into pipelines. Designed logging/telemetry for SIEM/SOAR with clear detection use cases. Proven track translating regulatory requirements into automated, #J-18808-Ljbffr

📌 It cloud security jr manager (Xico)
🏢 Aeromexico
📍 Xico