VP, Architecture - Security

Fidelity will not provide immigration sponsorship for this position.

Job Description:

The Role

Fidelity Enterprise Security Solution Architecture team is seeking a Vice President of Security Architecture to define and drive secure identity architecture providing cross cutting designs, patterns, standards and guidelines. Modern access paths span workforce users, external customers, privileged administrators, service accounts, APIs, AI agents, cloud roles, SaaS platforms, and machine identities. Decisions about authentication, authorization, privileged access, federation, secrets, identity lifecycle, and access governance will further enhance the security for our customers and platforms.

The role will provide a critical bridge between IAM engineering, BU application teams, cloud/platform engineering, risk, compliance, and security operations. This role within the Enterprise Security Architecture team is positioned to evaluate identity as an enterprise domain: how identities are created, trusted, elevated, monitored, and revoked across the environment.

The position provides technical and strategic vision and leadership for complex, multi-year initiatives, influencing product roadmaps, guiding the secure integration of our identities and creating enterprise security blueprints. It requires deep expertise in cloud, web, APIs, and modern architecture, along with strong strategic thinking and cross-functional collaboration to advance Fidelity’s cybersecurity innovation, reduce complexity, and strengthen customer protection.

The Expertise and Skills You Bring

• Enterprise identity strategy and architecture across workforce, customer, partner, non-human, machine, and AI-agent identities, including governance, lifecycle, trust relationships, and identity security controls.
• Identity data and identifier architecture, including authoritative sources, identity correlation, unique identifier strategies, and secure identity-sharing patterns across enterprise platforms.
• Experience defining enterprise identifier, identity-sharing, and authoritative source strategies to support secure, consistent identity management across platforms and business domains

• Security architecture patterns and governance controls for AI agents, machine identities, service accounts, workloads, APIs, and autonomous systems.

• Identity threat models and risk assessments for high-risk platforms, privileged workflows, critical applications, and cloud environments

• Identity-related security control requirements mapped to regulatory, audit, and internal policy expectations

• Exception review and risk disposition for identity security deviations, compensating controls, and remediation plans

• Partnership model with IAM engineering, application teams, cloud/platform teams, security operations, GRC, audit, and enterprise architecture

• Roadmap input for IAM, PAM, IGA, CIAM, Authorization, secrets management, certificate management, and cloud entitlement management capabilities

• Reusable architecture patterns, guardrails, and decision records that delivery teams can apply consistently

• Ability to translate business objectives into cohesive technical and security architectures aligned with enterprise standards

• Demonstrated success in building proofs of concept and delivering pragmatic, end-to-end solutions with clear adoption and migration plans
• Proven leadership in defining and evolving security strategies while influencing cross-functional teams and driving enterprise adoption
• Experience leading security architecture efforts, guiding engineering teams, and ensuring the implementation of security best practices

• Strong foundation in software engineering and continuous delivery practices, with excellent communication, collaboration, and problem-solving skills

• Relevant certifications such as CISSP, CISA, CCSP, AWS Security Specialty, or AWS Certified Solutions Architect preferred

• Minimum of 10 years of industry experience in architecting distributed systems and applications

The Team

Enterprise Cyber Security Architecture operates within Fidelity Architecture and Engineering and is responsible for laying a solid foundation for the Enterprise to secure customer and associate interactions. The team supports the Enterprise IAM and Digital Security and actively defines the security architecture for customer identity, authentication, authorization, fraud mitigation, cloud security, and data privacy.

Fidelity’s Onsite Working Model

Fidelity is transitioning to a full-time onsite working model through a phased rollout across regions and roles. Currently, some roles and locations require 100% onsite presence, while others require less. Onsite expectations are likely to evolve as the rollout continues. This transition does not apply to fully remote roles.

Certifications:

Category:

Please be advised that Fidelity’s business is governed by the provisions of the Securities Exchange Act of 1934, the Investment Advisers Act of 1940, the Investment Company Act of 1940, ERISA, numerous state laws governing securities, investment and retirement-related financial activities and the rules and regulations of numerous self-regulatory organizations, including FINRA, among others. Those laws and regulations may restrict Fidelity from hiring and/or associating with individuals with certain Criminal Histories.