Security Consultant and Solution Architect

Job Description
The role combines security technology delivery, governance and process consulting with general solution architecture. It translates business needs into practical, secure and supportable solutions, and owns delivery from initial assessment through design, implementation, testing, deployment, operational handover and stabilization. The position supports Financial Services CZ and can deliver projects across other sectors.

Your future duties and responsibilities
• Lead discovery workshops to capture business, security, regulatory and operational requirements, existing processes, dependencies, constraints and acceptance criteria.
• Assess the current environment and risks; design the target solution across applications, data, integration, infrastructure and cloud or hybrid services. Compare options against business value, risk, delivery effort and operating cost.
• Design and deliver SIEM, IAM/IDM and PAM integrations, including interfaces, data flows, access controls and supporting processes. Install and configure services, or guide engineers through implementation and resolve design issues.
• Translate security assessments into proportionate controls, process improvements and remediation plans. Work with governance, risk and compliance teams to define ownership, evidence and audit requirements.
• Coordinate security, infrastructure, application, operations and audit stakeholders; manage technical dependencies, delivery risks and workstreams within Agile or Waterfall projects.
• Define test strategy, hardening requirements, security and integration tests, and acceptance criteria. Review the implemented solution against the approved design and record changes and residual risks.
• Prepare operational monitoring, incident response, change and patch management, backup and disaster recovery arrangements. Deliver training, knowledge transfer, handover and hypercare through stabilization.
• Measure delivery and operational outcomes using agreed KPIs, including log source coverage, detection coverage, identity lifecycle performance and privileged account onboarding. At senior level, mentor colleagues and lead a workstream.

Typical deliverables
• Security and integration assessment, requirements catalogue and risk and remediation register.
• High level and low level designs (HLD/LLD), architecture diagrams, integration specifications, interface contracts and data flow maps.
• Architecture decision records, implementation roadmap and migration, cutover and rollback plans.
• SIEM detection use cases, IAM role and lifecycle models, PAM onboarding standards, and test plans with acceptance criteria.
• Runbooks, operating model, training materials, support ownership and an operational handover package.

Required qualifications to be successful in this role
Experience and core security domains
• Medior: typically 3+ years in security architecture, security engineering or enterprise integration. Senior: typically 5+ years, with evidence of delivery ownership and technical leadership. Experience may come from any sector.
• Infrastructure: practical understanding of networking, Windows and Linux, Active Directory, Microsoft Entra ID, and cloud and hybrid environments. Target 3-5 years of relevant infrastructure experience.
• SIEM: log onboarding, parsing, normalization, correlation, detection use cases, tuning, alerting and reporting; integration with SOAR and ITSM. Understand sources such as EDR, firewalls, IDS/IPS, proxy, server, application and cloud audit logs.
• IAM/IDM: identity lifecycle, provisioning and deprovisioning, SSO, MFA, federation using SAML/OIDC, RBAC/ABAC and access governance. Understand integration with HR systems, directory services, enterprise applications and SaaS.
• PAM: credential vaulting and rotation, session management and recording, approval workflows, just in time and just enough access, and onboarding servers, network devices, databases and application accounts.
• Target 3-5 years of relevant experience in SIEM, IAM/IDM and PAM, with practical installation and configuration capability in at least one domain. Target 3-5 years in GRC, risk management and the ISO 27000 and ISO 31000 families; apply controls and process analysis to delivery.
General solution architecture requirements
• Translate business capabilities and functional requirements into a coherent solution design. Define measurable nonfunctional requirements for availability, performance, scalability, resilience, security, privacy, maintainability and supportability.
• Design application boundaries, data models and flows, integration patterns and interfaces. Select suitable APIs, connectors, syslog, agents and event streaming; account for authentication, authorization, errors and dependencies.
• Evaluate on premises, cloud, hybrid, commercial and custom options. Explain technology selection and build versus buy decisions, including licensing, total cost of ownership, vendor constraints and lifecycle implications.
• Produce clear architecture diagrams, HLD/LLD and decision records. Maintain traceability from requirements to design, implementation and acceptance; align with enterprise standards and architecture governance.
• Plan incremental implementation, migration, cutover and rollback. Validate critical assumptions with prototypes or proofs of concept; review designs and guide delivery teams through technical tradeoffs.
• Design an operating model covering observability, service levels, incident response, change management, patching, backup and disaster recovery, with clear ownership and support handover.

Additional requirements and advantages
Czech and English are required. A formal degree is not required. Strong stakeholder communication, facilitation and documentation skills are essential. Designing and performing security or audit controls, and familiarity with NIST, CIS Controls and ITIL, are advantages.
Useful platform experience includes Microsoft Sentinel, Splunk, QRadar or Elastic; SailPoint, ForgeRock, Keycloak or Microsoft Entra ID; and CyberArk, BeyondTrust or Delinea. SOAR and ITSM integrations, PowerShell or Python automation, and experience in regulated sectors are advantages.

What we offer:
· Share Purchase Plan
· CGI’s My Assistance Program
· Compensation for long term sickness up to 30 days
· Interest-free company loan
· Referral bonus
· Lunch vouchers – 140CZK
· Group life insurance
· Flu and tick vaccination
· MultiSport card
· Cafeteria Benefit System – 900CZK monthly
· Hybrid Working Model & Flexible working hours
· 5 weeks of vacation + 3 sick days
· Birthday Leave and CSR day
And many more…
#LI-PMOL
Společně, jako vlastníci, převádíme odborné znalosti do praxe.
Život ve společnosti CGI je založen na vlastnictví, týmové práci, respektu a pocitu sounáležitosti. U nás můžete naplno využít svůj potenciál.
Zveme vás, abyste se od prvního dne stali vlastníky. Společně pracujeme na tom, aby se náš sen stal skutečností. Proto o sobě mluvíme jako o partnerech CGI, a ne jako o zaměstnancích. Těžíme z našeho společného úspěchu a máme možnost a odpovědnost aktivně se podílet na směřování a strategii naší společnosti.
Vaše práce vytváří hodnoty. Budete rozvíjet inovativní řešení a trvalé vztahy s kolegy a klienty a zároveň budete mít přístup ke globálním možnostem, abyste mohli proměnit své nápady ve skutečnost, využít nové příležitosti a těžit z předních odborných znalostí v oboru a technologií.
Budete rozvíjet svou kariéru tím, že se připojíte ke společnosti, která je postavena, aby rostla a přetrvala. Podpoří vás vedoucí pracovníci, kterým záleží na vašem zdraví a pohodě, a kteří vám pomohou využít příležitostí k rozvoji vašich dovedností a rozšíření obzorů.
Přidejte se k nám, k jedné z největších firem poskytujících poradenské služby v oblasti IT na světě.
Security Consultant and Solution Architect
Position Description
The role combines security technology delivery, governance and process consulting with general solution architecture. It translates business needs into practical, secure and supportable solutions, and owns delivery from initial assessment through design, implementation, testing, deployment, operational handover and stabilization. The position supports Financial Services CZ and can deliver projects across other sectors.
Your future duties and responsibilities
• Lead discovery workshops to capture business, security, regulatory and operational requirements, existing processes, dependencies, constraints and acceptance criteria.
• Assess the current environment and risks; design the target solution across applications, data, integration, infrastructure and cloud or hybrid services. Compare options against business value, risk, delivery effort and operating cost.
• Design and deliver SIEM, IAM/IDM and PAM integrations, including interfaces, data flows, access controls and supporting processes. Install and configure services, or guide engineers through implementation and resolve design issues.
• Translate security assessments into proportionate controls, process improvements and remediation plans. Work with governance, risk and compliance teams to define ownership, evidence and audit requirements.
• Coordinate security, infrastructure, application, operations and audit stakeholders; manage technical dependencies, delivery risks and workstreams within Agile or Waterfall projects.
• Define test strategy, hardening requirements, security and integration tests, and acceptance criteria. Review the implemented solution against the approved design and record changes and residual risks.
• Prepare operational monitoring, incident response, change and patch management, backup and disaster recovery arrangements. Deliver training, knowledge transfer, handover and hypercare through stabilization.
• Measure delivery and operational outcomes using agreed KPIs, including log source coverage, detection coverage, identity lifecycle performance and privileged account onboarding. At senior level, mentor colleagues and lead a workstream.
Typical deliverables
• Security and integration assessment, requirements catalogue and risk and remediation register.
• High level and low level designs (HLD/LLD), architecture diagrams, integration specifications, interface contracts and data flow maps.
• Architecture decision records, implementation roadmap and migration, cutover and rollback plans.
• SIEM detection use cases, IAM role and lifecycle models, PAM onboarding standards, and test plans with acceptance criteria.
• Runbooks, operating model, training materials, support ownership and an operational handover package.
Required qualifications to be successful in this role
Experience and core security domains
• Medior: typically 3+ years in security architecture, security engineering or enterprise integration. Senior: typically 5+ years, with evidence of delivery ownership and technical leadership. Experience may come from any sector.
• Infrastructure: practical understanding of networking, Windows and Linux, Active Directory, Microsoft Entra ID, and cloud and hybrid environments. Target 3-5 years of relevant infrastructure experience.
• SIEM: log onboarding, parsing, normalization, correlation, detection use cases, tuning, alerting and reporting; integration with SOAR and ITSM. Understand sources such as EDR, firewalls, IDS/IPS, proxy, server, application and cloud audit logs.
• IAM/IDM: identity lifecycle, provisioning and deprovisioning, SSO, MFA, federation using SAML/OIDC, RBAC/ABAC and access governance. Understand integration with HR systems, directory services, enterprise applications and SaaS.
• PAM: credential vaulting and rotation, session management and recording, approval workflows, just in time and just enough access, and onboarding servers, network devices, databases and application accounts.
• Target 3-5 years of relevant experience in SIEM, IAM/IDM and PAM, with practical installation and configuration capability in at least one domain. Target 3-5 years in GRC, risk management and the ISO 27000 and ISO 31000 families; apply controls and process analysis to delivery.
General solution architecture requirements
• Translate business capabilities and functional requirements into a coherent solution design. Define measurable nonfunctional requirements for availability, performance, scalability, resilience, security, privacy, maintainability and supportability.
• Design application boundaries, data models and flows, integration patterns and interfaces. Select suitable APIs, connectors, syslog, agents and event streaming; account for authentication, authorization, errors and dependencies.
• Evaluate on premises, cloud, hybrid, commercial and custom options. Explain technology selection and build versus buy decisions, including licensing, total cost of ownership, vendor constraints and lifecycle implications.
• Produce clear architecture diagrams, HLD/LLD and decision records. Maintain traceability from requirements to design, implementation and acceptance; align with enterprise standards and architecture governance.
• Plan incremental implementation, migration, cutover and rollback. Validate critical assumptions with prototypes or proofs of concept; review designs and guide delivery teams through technical tradeoffs.
• Design an operating model covering observability, service levels, incident response, change management, patching, backup and disaster recovery, with clear ownership and support handover.
Additional requirements and advantages
Czech and English are required. A formal degree is not required. Strong stakeholder communication, facilitation and documentation skills are essential. Designing and performing security or audit controls, and familiarity with NIST, CIS Controls and ITIL, are advantages.
Useful platform experience includes Microsoft Sentinel, Splunk, QRadar or Elastic; SailPoint, ForgeRock, Keycloak or Microsoft Entra ID; and CyberArk, BeyondTrust or Delinea. SOAR and ITSM integrations, PowerShell or Python automation, and experience in regulated sectors are advantages.
What we offer:
· Share Purchase Plan
· CGI’s My Assistance Program
· Compensation for long term sickness up to 30 days
· Interest-free company loan
· Referral bonus
· Lunch vouchers – 140CZK
· Group life insurance
· Flu and tick vaccination
· MultiSport card
· Cafeteria Benefit System – 900CZK monthly
· Hybrid Working Model & Flexible working hours
· 5 weeks of vacation + 3 sick days
· Birthday Leave and CSR day
And many more…
#LI-PMOL
Together, as owners, let’s turn meaningful insights into action.
Life at CGI is rooted in ownership, teamwork, respect and belonging. Here, you’ll reach your full potential because…
You are invited to be an owner from day 1 as we work together to bring our Dream to life. That’s why we call ourselves CGI Partners rather than employees. We benefit from our collective success and actively shape our company’s strategy and direction.
Your work creates value. You’ll develop innovative solutions and build relationships with teammates and clients while accessing global capabilities to scale your ideas, embrace new opportunities, and benefit from expansive industry and technology expertise.
You’ll shape your career by joining a company built to grow and last. You’ll be supported by leaders who care about your health and well-being and provide you with opportunities to deepen your skills and broaden your horizons.
That same commitment to fairness extends to how we use technology. To support our recruitment team, AI tools may be used to help assess applications though they never replace human judgement. All hiring decisions remain entirely in the hands of our recruitment professionals.
Come join our team—one of the largest IT and business consulting services firms in the world.
Security Consultant and Solution Architect

Security Consultant and Solution Architect

Začněte e-mailem