{"id":2942190,"url":"https://alion.io/job/avepoint-principal-security-architect-identity-resilience","title":"Principal Security Architect, Identity Resilience","company":{"id":95172,"name":"AvePoint","domain":"avepoint.com","url":"https://alion.io/company/avepoint-us","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"B","score":80,"open_postings":283,"ghost_share":0.251,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":150,"computed_at":"2026-10-27T05:46:45Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["New York, United States","Jersey City, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":null,"max":270000,"currency":"USD","period":"year","gross":null,"usd_annual":270000},"salary_estimate":null,"experience_years_min":12,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"Active Directory","optional":false},{"name":"Crowdstrike","optional":false},{"name":"DNS","optional":false},{"name":"IAM","optional":false},{"name":"LDAP","optional":false},{"name":"Least Privilege","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"PKI","optional":false},{"name":"Splunk","optional":false},{"name":"Threat Modeling","optional":false}],"status":"live","first_seen_at":"2026-10-20T17:36:40Z","employer_posted_date":"2026-10-20","last_verified_at":"2026-10-27T13:53:33Z","board_verified":true,"closed_at":null,"days_open":7,"trust":{"level":"ok","repost_count":0,"flags":["company_stale"],"days_open":6},"description":"About AvePoint: \nBeyond Secure. AvePoint is the global leader in data security, governance, and resilience, going beyond traditional solutions to ensure a robust data foundation and enable organizations everywhere to collaborate with confidence. Over 25,000 customers worldwide rely on the AvePoint Confidence Platform to prepare, secure, and optimize their critical data across Microsoft, Google, Salesforce, and other collaboration environments. AvePoint’s global channel partner program includes approximately 5,000 managed service providers, value-added resellers, and systems integrators, with our solutions available in more than 100 cloud marketplaces. To learn more, visit www.avepoint.com.\nAt AvePoint, we are committed to investing in our people. Agility, passion and teamwork set us up to do our best work and foster a culture where you are empowered to craft your career, make an impact, and own (y)our future. Unleash the power of you!\nAbout the position: \nThe Principal Architect for Identity Security will serve as the senior technical authority for the security architecture of AvePoint’s identity resilience initiatives. This role is focused on how enterprise identity providers, identity control planes, privileged access systems, application identities, and hybrid identity environments are secured, trusted, contained, recovered, and validated before, during, and after a disaster or identity compromise. Active Directory and Microsoft Entra ID are two of the most important identity platforms for this role, but the scope is broader than any single provider. \nThis role is intentionally separate from a platform-specific backup and recovery architect role. Backup and recovery architects may own the core backup, restore, rollback, topology, and source-of-authority architecture for specific platforms. This identity security architect owns the threat model, control-plane security, recovery trust model, incident-response integration points, secure restore guardrails, and post-recovery validation requirements that ensure identity resilience platforms can be trusted in adversarial conditions. \nThe ideal candidate has deep hands-on experience securing complex enterprise identity environments, including Active Directory, Microsoft Entra ID, hybrid identity, privileged access, application and workload identities, federation, identity governance integrations, and identity incident response. They can speak credibly with CISOs, identity architects, incident responders, platform engineers, and product leaders, while translating that expertise into product architecture, security requirements, and customer-facing recovery guidance. \nThis is not a generic IAM governance role and not a pure SOC analyst role. The right person understands identity as Tier-0 infrastructure, knows how attackers persist across identity systems, and can design product workflows that help customers prepare, recover, and validate a trusted known-good state after a serious incident. \nSpecific responsibilities include, but are not limited to: \nOwn the security architecture for AvePoint’s identityresilience platforms, including threat modeling, recovery trust criteria, privileged-access safeguards, secure restore guardrails, and post-recovery validation workflowsacross major enterprise identity providers. \nPartner with platformbackup and recovery architectsto ensure identity restore, relationship recovery, policy recovery, andsource-of-authority workflows operate safely under breach conditions, not just during normal administrative recovery. \nDefine the product’s Tier-0 security model, including least privilege, just-in-time elevation, credential isolation, gMSA usage, privileged access workstation expectations, break-glass handling, secure service accounts, immutable audit trails, and separation of monitoring vs. restore permissions. \nDesign security requirements for protecting the backup control plane: administrator roles, service app permissions, consented permissions, BYOS storage controls, network restrictions, key management, deletion approvals, retention tamper resistance, and recovery-data integrity validation. \nDefine how the product should support pre-breach recovery readiness, including known-good state documentation, critical identity object inventory, break-glass validation guidance, restore permission validation, and out-of-band communications readiness. \nArchitect secure workflows for identitybreach recovery phases: trusted control, detection and triage support, user containment handoff, applicationand workload identity containment handoff, persistence review, environment trust decision gates, known-good restore, downstream workloadrecovery, and validation. \nTranslate identityattack and persistence patterns into product requirements, including malicious applicationregistrations, service-principal credential abuse, illicit consent grants, access-policytampering, privileged role assignment changes, risky federation or trust changes, guest-user persistence, and group membership abuse. \nDefine containment handoff requirements for identity security teams, including when the product should guide or warn customers about token/session revocation, password reset sequencing, service-principal credential rotation, app disablement, admin-consent review, and emergency Conditional Access controls. \nDesign safe Conditional Access recovery patterns, including dependency validation, break-glass account protection, policy state handling, restore-as-disabled/report-only options where supported, and approval checkpoints before re-enabling high-impact policies. \nDesign security requirements for application recovery, including generated app secrets, new key IDs, API permission re-consent, Enterprise Application permission caveats, SSO/provisioning validation, credential rotation workflows, and secure reporting of secrets or remediation tasks. \nDefine how the product should compare current state against known-good backups without overclaiming detection: post-recovery-point objects, changed privileged assignments, changed app credentials, modified CA policies, changed Named Locations, and changed memberships. \nOwn the security validation model after restore: critical object validation, privileged access validation, app/service-principal validation, CA dependency validation, break-glass access validation, manual remediation checklists, and evidence/reporting for security, audit, and compliance teams. \nContribute deep expertise where identity platforms require specialized recoverysecurity guidance, including Active Directory forest/domain trust risk, domain controller trust boundaries, krbtgt and privileged credential handling, AD CS and certificate abuse considerations, SYSVOL/GPO integrity, DNS trust assumptions, and safe sequencing during forest recovery. \nPartner with Product, Engineering, Architecture, Security, and Field teams to convert security and recovery requirements into epics, design reviews, acceptance criteria, test plans, and customer-facing recovery guidance. \nConduct customer and field discovery with CISOs, incident responders, AD architects, Entra ID administrators, identity security teams, MSPs, and regulated/government customers to validate real-world security and recovery scenarios. \nTrack competitor and market patterns across Microsoft, Semperis, Quest, Cayosoft, Rubrik, Commvault, Veeam, CrowdStrike Identity, Microsoft Defender for Identity, and related ITDR/identity-resilience vendors, with an emphasis on security and recovery workflows rather than generic feature comparison. \nMentor internal engineering and product teams on AD/Entra security concepts, identity attack paths, recovery safety principles, and how to build security-first workflows for Tier-0 infrastructure. \nWhat you will bring to our team: \nBachelor’s degree in Computer Science, Engineering, Information Systems, Cybersecurity, or a related technical field; equivalent practical experience strongly considered. \n12+ years of hands-on technical experience in identity infrastructure, cybersecurity architecture, incident response, or security engineering, with deep specialization in enterprise identity security. \nDirect experience securing or recovering complex identityenvironments, including Active Directory, Microsoft Entra ID, hybrid identity, federation, trust relationships, privileged access boundaries, application identities, workload identities, and ransomware or destructive-attack readiness. \nDeep understanding of AD security internals: Kerberos, NTLM, LDAP, ACLs/delegation, privileged groups, admin tiering, DCSync/replication rights, krbtgt rotation, golden/silver ticket risk, domain/forest trusts, SID history, SPNs, constrained/unconstrained/resource-based constrained delegation, SYSVOL/GPO security, DNS, and AD CS/PKI risk. \nDeep understanding of Entra ID security architecture: Conditional Access, PIM, privileged roles, administrative units, authentication methods, Identity Protection, app registrations, enterprise applications, service principals, OAuth consent, workload identities, cross-tenant access, federation, and token/session behavior. \nStrong understanding of hybrid identity security: Entra Connect, Cloud Sync, password hash sync, pass-through authentication, AD FS/federation, sourceAnchor/ImmutableID, hard/soft match, source-of-authority conflicts, and how on-premises compromise can affect Microsoft 365/Entra environments. \nHands-on experience with identity incident response and recovery workflows, including compromised user containment, refresh-token/session revocation concepts, application/service-principal compromise response, API consent review, credential rotation, Conditional Access emergency response, and persistence removal. \nExperience designing security architecture for high-privilege tools or platforms that operate against Tier-0 infrastructure, including secure credential handling, least privilege, separation of duties, audit logging, tamper resistance, approval workflows, and customer-managed key/storage models. \nFamiliarity with disaster recovery and business continuity requirements for identity systems, including RTO/RPO tradeoffs, known-good baselines, clean recovery environments, in-place vs. clean-tenant recovery decisions, and post-restore validation. \nAbility to translate complex security requirements into product requirements, architecture patterns, workflow guardrails, customer-facing warnings, and acceptance criteria that engineering teams can implement. \nStrong customer-facing credibility with CISOs, identity architects, AD engineers, SOC/IR teams, compliance leaders, and executive stakeholders. \nDemonstrated ability to lead without authority across Product, Engineering, Security, Architecture, Customer Success, Sales Engineering, and partner teams. \nBonus: Experience working at or with vendors that build AD/Entra backup, recovery, ITDR, identity protection, or hybrid identity resilience products, such as Semperis, Quest, Cayosoft, Microsoft, Rubrik, Commvault, Veeam, CrowdStrike Identity, Mandiant, or equivalent. \nBonus: Experience with Microsoft Defender for Identity, Microsoft Defender XDR, Microsoft Sentinel, Splunk, CrowdStrike, Semperis DSP, Quest, Cayosoft Guardian, or similar identity detection/response ecosystems. \nBonus: Relevant certifications or recognition such as Microsoft Certified: Cybersecurity Architect Expert, Identity and Access Administrator, CISSP, GIAC, Microsoft MVP, or equivalent hands-on expertise. \nThe Salary Range for this role is $180,000k - $270,000. At AvePoint, we strive to offer competitive, fair, and equitable total rewards. The listed salary range represents a good faith estimate, with final offers based on location, experience, skills, and qualifications. The listed range reflects base salary only; our total rewards include base salary, comprehensive benefits (medical, dental, vision, 401(k) with match, unlimited PTO), and depending on the role, bonuses, commissions, or...","description_format":"text","description_chars":12276,"description_truncated":true,"requirements":{"experience_years_min":12,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Equity","Unlimited PTO"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Identity Management","Data Governance & Catalogs","Security Compliance","Backup & Disaster Recovery"],"lifecycle":[{"event":"open","at":"2026-10-20T17:38:33Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"green card filings: 2","filings_12m":0,"filings_prev_12m":1,"green_card_filings_12m":2,"median_offered_wage_usd":97500,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":0}],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":6,"expected_fill_days":150,"reasons":["conf:0","velocity","win:early","comp:brand"],"computed_at":"2026-10-27T05:46:45Z"},"pay":{"stated_usd_annual":270000,"is_top_pay":true},"html_url":"https://alion.io/job/avepoint-principal-security-architect-identity-resilience","json_url":"https://alion.io/job/avepoint-principal-security-architect-identity-resilience.json","meta":{"generated_at":"2026-10-27T18:37:47Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":8814,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-28T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":95172},"rest":"https://alion.io/mcp/rest/get_company?id=95172"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Favepoint-principal-security-architect-identity-resilience"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Favepoint-principal-security-architect-identity-resilience"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Favepoint-principal-security-architect-identity-resilience"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/avepoint-principal-security-architect-identity-resilience\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Favepoint-principal-security-architect-identity-resilience"}]}