Cloud Security Architect

This is a US-based remote role. You will be required to interview in person.

About SailPoint

SailPoint is defining the next era of identity security. Our unified, AI-powered platform seamlessly secures both the Human Fabric of your workforce and the Agentic Fabric of AI and non-human identities, completely eliminating organizational blind spots.

Built on core principles like zero-standing privilege and contextualized risk, our platform transforms identity from a vulnerability into a strategic business advantage. Today, we are trusted by some of the largest, most complex organizations in the world to deliver intelligent, autonomous identity security at scale.

About the role

SailPoint’s Cybersecurity organization is seeking a Cloud Security Architect with 5+ years of experience to design, implement, and govern secure cloud infrastructure across our organization. This position reports to the Director of Cyber Product Security (CPS) and the successful candidate will join a team of security engineers who collaborate with stakeholders across the organization. This role will govern the security architecture for our cloud environments (AWS/Azure/GCP), partner closely with Engineering, DevOps, and IT teams, and ensure our cloud posture meets both business needs and regulatory requirements. The ideal candidate combines deep technical expertise with the ability to translate security requirements into practical, scalable solutions.

The Cloud Security Architect will have the opportunity to shape our future through process and technology optimization, capability acquisition and development, and maturation of our existing activities. They’ll already be comfortable with the 4 I’s at SailPoint (individual, Impact, Innovation, and Integrity) even if they’re new to the concept. They will embrace new challenges and will be a positive contributor to an already positive work culture and environment.

Key Responsibilities

· Design and implement secure cloud architecture patterns across IaaS, PaaS, and SaaS environments

· Define and enforce cloud security standards, reference architectures, and guardrails (landing zones, network segmentation, identity boundaries)

· Lead security reviews of new cloud initiatives, providing architecture guidance from design through deployment

· Architect and oversee Identity and Access Management (IAM) strategies, including least-privilege access, federation, and role-based access control

· Partner with other teams in Cyber like VM to evaluate and implement cloud-native and third-party security tools (CSPM, CWPP, CIEM, SIEM/SOAR integrations)

· Partner with DevOps/Platform teams to embed security into CI/CD pipelines (DevSecOps, Infrastructure as Code security scanning)

· Conduct threat modeling and risk assessments for cloud workloads and services

· Ensure compliance with relevant frameworks (SOC 2, ISO 27001, NIST, CIS Benchmarks as applicable)

· Develop and maintain documentation, runbooks, and architecture diagrams for cloud security controls

· Mentor engineering teams on secure cloud design principles and serve as a security subject-matter expert

· Stay current on emerging cloud threats, vulnerabilities, and vendor security capabilities

Required Qualifications

· 5+ years of experience in cloud security, security architecture, or related infrastructure security roles

· Mandatory - Demonstrated hands-on experience securing workloads in AWS, Azure, and/or GCP

· Strong understanding of IAM, network security, encryption, and key management in cloud environments

· Experience with cloud security tooling (e.g., AWS Security Hub, Azure Defender, Prisma Cloud, Wiz, Orca Security, or similar CSPM/CWPP platforms)

· Demonstrable experience with container and Kubernetes security

· Working knowledge of compliance frameworks (SOC 2, ISO 27001, NIST 800-53, CIS Benchmarks)

· Experience with Infrastructure as Code and integrating security into CI/CD pipelines

· Relevant certifications preferred: CCSP, AWS Certified Security - Specialty, Azure Security Engineer, or Google Professional Cloud Security Engineer

Core Competencies

· Technical Depth: Strong hands-on experience with at least one major cloud provider (AWS, Azure, or GCP); working knowledge of multi-cloud concepts is a plus

· Security Architecture: Ability to design defense-in-depth architectures balancing security, cost, and performance

· Automation Mindset: Comfort with Infrastructure as Code (Terraform, CloudFormation, ARM/Bicep) and scripting (Python, Bash, PowerShell)

· Communication: Ability to explain complex security concepts to both technical and non-technical stakeholders

· Collaboration: Track record of working cross-functionally with engineering and IT teams

· Analytical Thinking: Strong risk assessment and threat modeling capabilities

· Adaptability: Comfortable operating in fast-changing environments with evolving cloud services and threat landscapes

· Attack path analysis and exposure validation: Prioritizing risk by analyzing how misconfigurations, vulnerabilities, and identity permissions combine into exploitable paths rather than treating each finding in isolation

· Leadership: Ability to influence without direct authority and drive security best practices across teams

Roadmap for Success

First 90 Days - Foundation & Assessment

· Complete onboarding and gain access to cloud environments, tooling, and key documentation

· Conduct a comprehensive assessment of current cloud security posture (identify gaps, quick wins, and high-risk areas)

· Build relationships with key stakeholders: engineering leads, DevOps, and IT

· Deliver an initial findings report with prioritized recommendations

· Begin remediation of any critical/high-severity findings identified during assessment

· Understand existing architecture, IAM structures, and network topology across cloud accounts/subscriptions

First 6 Months - Execution & Standardization

· Design and publish core cloud security reference architectures and standards (landing zones, network segmentation, IAM baseline)

· Optimize security review processes for new cloud projects

· Reduce identified critical/high-risk findings from the initial assessment by a target percentage (e.g., 80%)

· Partner with DevOps to integrate security checks into CI/CD pipeline

· Deliver security architecture training/enablement session(s) to engineering teams

· Demonstrate measurable improvement in cloud security posture metrics (e.g., CSPM score, open findings trend)

First 12 Months - Maturity & Strategic Impact

· Achieve target compliance posture for relevant frameworks (SOC 2, ISO 27001, etc.) as applicable to cloud environments

· Optimize a repeatable, scalable cloud security architecture review process adopted across engineering teams

· Demonstrate a mature DevSecOps integration with automated security gates in CI/CD

· Serve as the recognized go-to expert for cloud security architecture decisions across the organization

· Contribute to or lead the organization's cloud security roadmap for the following year

· Show quantifiable risk reduction (e.g., reduction in mean time to remediate findings, reduction in exposed critical assets)

· Mentor at least one other team member or contribute to building broader security architecture capability within the team

Benefits

At SailPoint, our identity security innovations are powered by a global crew. We are proudly headquartered in Austin, Texas, with a beautiful campus that overlooks the scenic 4 Points Preserve. We embrace a flexible, remote-first work culture that prioritizes personal autonomy, trust, and work-life balance. Working here is defined by "The SailPoint Way"; a highly collaborative and inclusive environment where leadership is transparent, "smart jerks" are not tolerated, and crew members have the freedom to drive real impact in security.

We provide:

Competitive Compensation

• Flexible Time Off: Trust-based vacation policies alongside paid company holidays to help you recharge.
• Comprehensive Healthcare: Premium medical, dental, and vision insurance options
• Career Growth Opportunities
• Plus so much more!

Benefits and Compensation listed vary based on the location of your employment and the nature of your employment with SailPoint.

As a part of the total compensation package, this role may be eligible for the SailPoint Corporate Bonus Plan or a role-specific commission, along with potential eligibility for equity participation. SailPoint maintains broad salary ranges for its roles to account for variations in knowledge, skills, experience, market conditions and locations, as well as reflect SailPoint’s differing products, industries, and lines of business. Candidates are typically placed into the range based on the preceding factors as well as internal peer equity. We estimate the base salary, for US-based employees, will be in this range from (min-max, USD):

$174,200 - $293,702.00

Base salaries for employees based in other locations are competitive for the employee’s home location.

Benefits Overview

1. Health and wellness coverage: Medical, dental, and vision insurance

2. Disability coverage: Short-term and long-term disability

3. Life protection: Life insurance and Accidental Death & Dismemberment (AD&D)

4. Additional life coverage options: Supplemental life insurance for employees, spouses, and children

5. Flexible spending accounts for health care, and dependent care; limited purpose flexible spending account

6. Financial security: 401(k) Savings and Investment Plan with company matching

7. Time off benefits: Flexible vacation policy

8. Holidays: 8 paid holidays annually

9. Sick leave

10. Parental support: Paid parental leave

11. Employee Assistance Program (EAP) and Care Counselors

12. Voluntary benefits: Legal Assistance, Critical Illness, Accident, Hospital Indemnity and Pet Insurance options

13. Health Savings Account (HSA) with employer contribution

SailPoint is an equal opportunity employer and we welcome all qualified candidates to apply to join our team. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, protected veteran status, or any other category protected by applicable law.

Alternative methods of applying for employment are available to individuals unable to submit an application through this site because of a disability. Contact applicationassistance@sailpoint.com or mail to 11120 Four Points Dr, Suite 100, Austin, TX 78726, to discuss reasonable accommodations. NOTE: Any unsolicited resumes sent by candidates or agencies to this email will not be considered for current openings at SailPoint.

About Us

SailPoint (Nasdaq: SAIL) is defining the new era of adaptive identity security. In a world where non-human identities now significantly outnumber humans, our AI-powered platform unifies identity, security, and data intelligence to protect today’s enterprise from advanced identity-based threats. We deliver the identity solution that spans both the breadth of identities and the depth of context needed to drive real-time access with confidence. Built on principles like zero-standing privilege and contextualized risk, our SailPoint platform transforms identity from a point of vulnerability into a powerful security advantage. Trusted by many of the world's leading organizations, SailPoint secures the enterprise with intelligent, autonomous identity security.

Equal Employment Opportunity Policy Statement

The employment policy of SailPoint is to provide equal opportunity to all persons, and it is SailPoint’s policy to take affirmative action to employ and advance in employment protected veterans and individuals with disabilities.

It is SailPoint’s policy to recruit, hire, train and promote qualified individuals in all job titles, and ensure that all other personnel actions are administered without regard to race, color, religion, national origin, sex, military and/or veteran status, disability, or other legally protected status, and we will ensure that all employment decisions are based only on valid job requirements. SailPoint does not discriminate on the basis of national origin or citizenship status as provided under the Immigration Reform and Control Act of 1986.

Employees and applicants shall not be subjected to harassment, intimidation, threats, coercion, or discrimination because they have engaged in or may engage in any of the following activities:

• Filing a complaint;

• Assisting or participating in an investigation, compliance evaluation, hearing, or any other activity related to the administration of the affirmative action provisions of Section 503, VEVRAA, or any other Federal, State or local law requiring equal opportunity for individuals with disabilities or protected veterans;

• Opposing any act or practice made unlawful by Section 503, VEVRAA, or their implementing regulations in this part, or any other Federal, State or local law requiring equal opportunity for individuals with disabilities or protected veterans; or

• Exercising any other right protected by section 503, VEVRAA or their implementing regulations.

SailPoint will also provide reasonable accommodation to known physical or mental limitations of an otherwise qualified employee or applicant for employment, unless the accommodation would impose undue hardship on the operation of our business.

SailPoint’s affirmative action program contains an audit and reporting system which enables us to measure the effectiveness of our program, indicate any need for remedial action, determine the degree to which our objectives have been attained, determine whether protected veterans and individuals with disabilities had had the opportunity to participate in company-sponsored activities, measure our compliance with the program’s specific obligations, and document actions taken to comply with these obligations.