Top Senior Cyber Security Jobs in Rochester, NY

Manage and maintain the company’s ISO 27001 and ISMS program, including policies, document control, risk registers, control ownership, audits, corrective actions, evidence collection, GRC administration, compliance calendars, metrics, and executive reporting. Coordinate with security, IT, operations, auditors, vendors, and business stakeholders. Support incident response, business continuity, disaster recovery, crisis management, and continual improvement while ensuring physical and digital security systems meet applicable standards.

Leads complex cybersecurity initiatives, including Microsoft Purview DLP and data classification, third-party risk assessments, security architecture, vulnerability scanning, penetration testing, and incident response. Designs and manages enterprise security solutions, investigates application and service security, performs risk assessments and root-cause analysis, and advises stakeholders on security practices. The role also mentors colleagues, documents processes, and supports emerging AI and cloud security risks.

Leads research security and sponsored research compliance for federally funded and industry-sponsored projects. Oversees CMMC compliance, evaluates protected-data obligations, conducts gap analyses, develops project-specific control plans, supports audits and assessments, provides sponsor certifications, and maintains compliance documentation. Advises and trains researchers and stakeholders on cybersecurity, controlled data, privacy, and regulatory requirements while developing practical policies and institutional controls.

Lead product vision and strategy for security operations services, defining outcomes for managed investigation, response, threat hunting, and advisory services. Partner with customer security ops, product, and marketing teams to deliver AI-driven, automated features, represent Zscaler to customers, and drive measurable security outcomes and operational alignment.

Lead Coinbase's global IT and security audit program, delivering complex cross-functional audits across cloud, infrastructure, cybersecurity, IAM, data protection, and third-party risk. Manage and develop a global audit team, partner with first- and second-line stakeholders to drive integrated assurance, and report executive-level findings to senior leadership and the Audit Committee. Modernize audit execution through data analytics, automation, and generative AI to enable continuous monitoring and automated evidence retrieval.

Perform configuration, maintenance, and incident/change support for enterprise network security devices (firewalls, IPS, web filtering, SSL-VPN). Create test plans, evaluate COTS solutions, document troubleshooting/restoral, and train staff. Replace and manage multi-vendor firewalls and resolve ticket-queue incidents.

Design, implement, and support SAP security roles, GRC toolsets, SOD controls, and remediation across ECC, CRM, BW, BOBJ, and Solution Manager. Translate business requirements into secure technical specifications, support audits, change/transport approvals, documentation, training, and provide ad-hoc reporting and on-call/after-hours support as needed.

Lead presales technical strategy for cloud security solutions: design cloud-native/hybrid architectures (AWS required), run discovery workshops, own PoCs, support proposals and sales, ensure compliance and smooth handover to delivery teams.

As a Security Architect, you will build secure agent runtimes and systems, ensuring robust security capabilities in agentic AI solutions while conducting security evaluations.

Owner of Vannevar's authentication and authorization platform: build tenant-isolated auth systems, self-service user/group/permission admin UI, tooling to visualize and validate access, feature-flag and platform management interfaces, and shared authorization capabilities across products.

Lead and mature Affirm's third-party security risk program by designing controls, automating GRC workflows, evaluating third-party/cloud security, building integrations and dashboards, and advising stakeholders. Drive automation using Python and agentic coding tools, operate orchestration across systems, manage a portfolio of risk reviews, and establish metrics, processes, and reporting to scale security risk management.

Lead product security across the SDLC: threat modeling, secure architecture, vulnerability management, security testing and remediation, CI/CD/DevSecOps controls, AI security integration, bug bounty triage, developer training, and cross-functional security consulting to scale secure-by-design practices.

Lead and grow a Security Platform engineering team to design and operate centralized identity and access services (IdP integrations, SSO, authorization frameworks). Define roadmap, partner cross-functionally, and drive adoption of secure-by-default access controls across products.

Hands-on senior IT security systems administrator responsible for administering Google Workspace and Microsoft 365, managing Windows and Mac endpoints via MDM, operating identity and SSO/MFA systems, and running security tooling (EDR, DLP, SIEM, email security). Owns threat monitoring, incident response, vulnerability and patch management, compliance evidence, DR planning, security reporting, and vendor relationships for a remote distributed workforce.

Hands-on Staff Security Engineer to build and operate DevSecOps capabilities: automate security controls, harden AWS/cloud and CI/CD, improve supply-chain security, build detection/response tooling, partner with engineering for secure design, and lead incident response and compliance automation.

Lead research and deliver strategic and tactical advice on AI data security and AI ecosystem data management. Produce written research, briefings, and presentations; advise clients and stakeholders; grow networks of thought leaders and vendors; ensure research integrity and collaborate across Gartner to support deliverables. Travel up to 25%.

Own security and infrastructure for a fintech payments platform, with security comprising roughly two-thirds of the role. Responsibilities include cloud and application security, IAM, secrets management, threat modeling, detection engineering, incident response, vulnerability management, compliance, privacy, CI/CD, infrastructure as code, observability, reliability, backups, disaster recovery, and on-call operations. The role reports to the CTO and will establish the security function as the company’s founding security hire.

Serve as a senior security solution architect advising enterprise customers on modern, cloud-native Microsoft security architectures. Design and validate solutions using Microsoft security products, remove technical blockers, act as SME on complex deployments, gather customer insights to influence product roadmap and map solutions to business outcomes, and support large-scale security and compliance projects.

Design and assess secure systems for Microsoft business operations: perform threat modeling and security design assessments, drive risk-based architecture decisions, communicate risk, mentor teammates, and ensure compliance with security policies and screenings.

Lead a U.S.-based team of Security Operations Engineers and TPMs to design, build, and operationalize identity protections that reduce lateral-movement risk. Define strategy, apply AI and automation, partner with engineering and platform teams, deliver scalable controls, and drive measurable security outcomes, operational readiness, and executive reporting.

Lead Wikimedia Foundation’s product security strategy, prioritize security and privacy engineering initiatives, develop platform interventions against threats, strengthen organizational security culture, and communicate with Wikimedia communities. The role partners with cross-functional and departmental leaders on information security, represents the Foundation to volunteers, and applies AI-based tools to security analysis, code review, and software engineering. Prior product management experience is not required, but strong technical, security, communication, and online-community experience are important.

Manages information security risks, vendor and third-party risk reviews, mitigation plans, policy exceptions, and compliance reporting. Partners with stakeholders and Enterprise Risk Management to maintain risk policies within tolerance. Serves as a technical expert, supports risk awareness and accountability, monitors security controls, and contributes to operational goals. The role requires expertise in IT audit, security monitoring, access management, encryption, networking, incident response, SOX compliance, and project management.

Lead complex cloud, identity, supply-chain, and nation-state security investigations. Perform root-cause analysis, threat hunting, blast-radius assessment, attribution, and incident response across Microsoft telemetry. Operationalize intelligence into queries, detections, playbooks, and platform fixes; investigate adversary tradecraft; use AI-assisted tooling; produce executive-ready reports; and mentor peers in advanced investigations, forensics, and reverse engineering.

Administers Microsoft Defender services for a DoD customer, monitoring endpoint security, EDR, NGAV, attack-surface reduction, cloud protection, SIEM integrations, cross-platform controls, WDAC, DLP, compliance reporting, and security dashboards. Escalates anomalies, maintains policies and procedures, investigates alerts, and supports Windows, Linux, and mobile-device protection. Requires cybersecurity experience, Microsoft security expertise, DoD compliance knowledge, Security+ certification, and an active Secret clearance.

Lead enterprise AI security architecture, strategy, governance, and secure-by-design implementation across cloud, hybrid infrastructure, software, and AI/ML environments. Design security patterns for LLM hosting, agentic systems, vector databases, and inference endpoints; translate regulatory requirements into technical standards; review complex architectures; implement AI security guardrails and policy enforcement; advise engineering and product teams; and mentor teams while influencing senior stakeholders.