BCG is seeking a Global Cybersecurity Senior Manager to lead security architecture and governance across enterprise endpoints, mobile devices, servers, containers, and cloud workloads. This role supports the firm’s Zero Trust strategy by shaping secure, resilient infrastructure design throughout the solution lifecycle.
Key Responsibilities
- Define and maintain security architecture standards for enterprise endpoints, mobile devices, servers, containers, and cloud workloads, including configuration baselines, hardening requirements, endpoint protection, and security compliance.
- Anchor standards in an authoritative, continuously reconciled device and asset inventory, and develop reference architectures that combine device trust, endpoint compliance, and identity-based access controls to strengthen Zero Trust protections across BCG.
- Establish architectural requirements for enterprise device management platforms, including Microsoft Intune and Jamf, as well as endpoint detection and response (EDR), device compliance, and security controls that enable trusted access to enterprise resources.
- Define requirements for quantum-resistant full-disk encryption and PQ-aware key management across the device estate, including crypto-agile hardening standards that support transition to post-quantum algorithms without re-architecting.
- Guide security requirements for endpoint privilege management, local administrator access, just-in-time privilege elevation, server hardening, and patch management across on-premises and cloud environments.
- Define security architecture requirements for containerized workloads, server protection, and cloud-native application protection platforms (CNAPP, including Wiz), including standards for workload visibility, vulnerability management, configuration hardening, and security posture.
- Advance device security controls through configuration drift detection and automated remediation workflows, partnering with engineering to transition device governance from manual review to continuous, automated validation.
- Conduct security architecture reviews for device and workload initiatives, including issuing dispositions, conditions, and architectural decision records. Collaborate with the Secure Devices Engineering Squad, global technology teams, and Security Operations to integrate security requirements and validate control effectiveness through implementation.
- Route exceptions through ISRM governance with documented compensating controls and risk acceptance, and escalate unresolved architectural items.
- Establish device and endpoint telemetry requirements in partnership with Security Operations, which owns SIEM integration, detection engineering, and continuous monitoring.
Required Qualifications
- 6–10 years of experience in security architecture, infrastructure security, or security engineering.
- Deep expertise in endpoint security architecture, including Microsoft Intune, Jamf, EDR, and device management.
- Experience securing servers, containers, and cloud workloads using hardening standards and cloud security platforms.
- Strong knowledge of Zero Trust architecture, endpoint privilege management, CNAPP platforms (e.g., Wiz), and enterprise security frameworks, including container security benchmarks (NIST SP 800-190, CIS).
- Proven ability to apply architectural authority and independent, risk-based judgment while communicating technical decisions clearly and building consensus across global engineering, security, and technology teams.
Technology Focus
- Microsoft Intune
- Jamf
- EDR
- Zero Trust
- Quantum-resistant full-disk encryption
- PQ-aware key management
- Containerized workloads
- Cloud-native application protection platforms (CNAPP)
- Wiz
- SIEM
- NIST SP 800-190
- CIS
Compensation and Location
Location: Atlanta, GA (onsite). Salary: USD 155,000 - 191,000 per year. Experience: 6 years minimum.
For US locations only: Total compensation includes base salary, annual discretionary performance bonus, retirement contribution, and a market-leading benefits package. The Atlanta base salary range is $155,000 to $191,000. Bonus up to 20%, with retirement contributions starting at 5% and increasing to 10% after 2 years.
Benefits
- $0 health insurance premiums for BCG employees, spouses, and children
- $10 (USD) copays for trips to the doctor, urgent care visits, and prescriptions for generic drugs
- Dental coverage, including up to $5,000 in orthodontia benefits
- Vision insurance for glasses and contact lenses annually
- Gym membership and other fitness activity reimbursement
- Fully vested Profit Sharing Retirement Fund contributions made annually, whether or not you contribute, plus an option to make personal contributions to a 401(k) plan
- Paid parental leave and family benefits including elective egg freezing, surrogacy, and adoption reimbursement
- Generous paid time off including 12 holidays per year, an annual office closure between Christmas and New Years, and 15 vacation days per year (earned at 1.25 days per month)
- Paid sick time on an as-needed basis
How You Will Work
This role is part of the Infrastructure Security Architecture team within Information Security Risk Management (ISRM). You will serve as a key security architecture partner to the Secure Devices Engineering Squad and work in ISRM’s matrixed environment, partnering with Security Operations, Risk Management, and architecture peers to advance device- and workload-centric Zero Trust maturity.
For this role, in-person work is generally expected at a BCG office or with clients on a regular basis (typically around 50% of working time), depending on business needs and local policies and practices.
Bonus Compensation Details
Total compensation includes a base salary range and an additional discretionary performance bonus component of up to 20% (US locations only), along with retirement contributions that begin at 5% and move to 10% after 2 years.
