Security Consultant & Solution Architect

Quick Facts

Security Consultant & Solution Architect

Description

Drive end-to-end security technology delivery and solution architecture, turning business, security, regulatory, and operational needs into secure, supportable designs. Lead discovery, assess risks, design integrations for SIEM/IAM/PAM, and coordinate delivery across application, infrastructure, operations, and audit stakeholders. Own implementation through testing, deployment, operational handover, and stabilization while improving governance and remediation outcomes.

Responsibilities

• Lead discovery workshops to capture business, security, regulatory, and operational requirements, constraints, dependencies, and acceptance criteria
• Assess current environment and risks; design target solutions across applications, data, integration, infrastructure, and cloud/hybrid services and compare options by value, risk, effort, and operating cost
• Design and deliver SIEM, IAM/IDM, and PAM integrations (interfaces, data flows, access controls, supporting processes) and support implementation/configuration
• Convert security assessments into proportionate controls, process improvements, remediation plans, and governance evidence/audit requirements
• Coordinate security, infrastructure, application, operations, and audit stakeholders; manage technical dependencies and delivery risks in Agile or Waterfall projects
• Define test strategy, hardening requirements, security and integration tests, and acceptance criteria; review implementation vs. approved design
• Plan operational monitoring, incident response, change and patch management, backup and disaster recovery; deliver training and operational handover with hypercare
• Measure outcomes with agreed KPIs (log source coverage, detection coverage, identity lifecycle performance, privileged account onboarding) and mentor colleagues

Requirements

• 3+ years in security architecture/security engineering/enterprise integration (medior) or 5+ years with delivery ownership and technical leadership (senior)
• Infrastructure knowledge: networking, Windows, Linux, Active Directory, Microsoft Entra ID, and cloud/hybrid environments
• SIEM expertise: log onboarding, parsing/normalization, correlation, detection use cases, tuning, alerting, reporting; SOAR/ITSM integration
• IAM/IDM expertise: identity lifecycle, provisioning/deprovisioning, SSO/MFA, SAML/OIDC federation, RBAC/ABAC, access governance
• PAM expertise: credential vaulting and rotation, session management/recording, approval workflows, JIT/JEA access, privileged onboarding
• GRC/risk experience with ISO 27000 and ISO 31000 families; ability to apply controls and process analysis to delivery
• Capability to translate business requirements into coherent solution designs with measurable nonfunctional requirements
• Proficiency in producing architecture deliverables (HLD/LLD, architecture diagrams, decision records) with traceability and governance alignment
• Experience with incremental implementation, migration, cutover/rollback planning and validation via prototypes/POCs
• Czech and English language proficiency
• Strong stakeholder communication, facilitation, and documentation skills

Benefits

• Hybrid working model and flexible working hours
• Share Purchase Plan; interest-free company loan; referral bonus
• Lunch vouchers (140 CZK); Cafeteria Benefit System (900 CZK monthly)
• Group life insurance; My Assistance Program
• 5 weeks of vacation + 3 sick days; Birthday Leave and CSR day
• Compensation for long-term sickness up to 30 days; Flu and tick vaccinations; MultiSport card

Hard Skills & Technologies

• Security architecture
• Security engineering
• Enterprise integration
• SIEM
• Log onboarding
• Log parsing
• Log normalization
• Correlation
• Detection engineering
• Tuning
• Alerting
• Reporting
• SOAR
• ITSM integration
• Identity lifecycle
• Provisioning
• Deprovisioning
• SSO
• MFA
• SAML
• OIDC
• Federation
• RBAC
• ABAC
• Access governance
• PAM
• Credential vaulting
• Credential rotation
• Session recording
• Approval workflows
• GRC
• Risk management
• ISO27000
• ISO31000
• HLD
• LLD
• Architecture decision records
• Incident response
• Change management
• Patch management
• Backup
• Disaster recovery
• Observability
• Monitoring