Who We Are
Boston Consulting Group partners with leaders in business and society to tackle their most important challenges and capture their greatest opportunities. BCG was the pioneer in business strategy when it was founded in 1963. Today, we help clients with total transformation-inspiring complex change, enabling organizations to grow, building competitive advantage, and driving bottom-line impact.
To succeed, organizations must blend digital and human capabilities. Our diverse, global teams bring deep industry and functional expertise and a range of perspectives to spark change. BCG delivers solutions through leading-edge management consulting along with technology and design, corporate and digital ventures—and business purpose. We work in a uniquely collaborative model across the firm and throughout all levels of the client organization, generating results that allow our clients to thrive.
What You'll Do
As the Infrastructure Security Architect – Secure Data, you will serve as the dedicated security architecture partner for BCG’s Secure Data Engineering Squad, owning the cyber defense governance and technical protection requirements for data security architecture covering data loss prevention, classification enforcement, encryption, and secrets management.
The role operates under the shared accountability model between ISRM Security Architecture and Secure Infrastructure Engineering: ISRM defines how platforms are secured and governed through security standards and architecture strategy; Platform Engineering owns the physical and logical implementation, delivery, and operation of those platforms.
You will ensure the Secure Data portfolio aligns with BCG’s Global Information Security Policy (GISP), the Cybersecurity Control Framework (CSF-10 (Data Protection)), the Security Architecture Reference Model, and the CISA Zero Trust Maturity Model (Data pillar), embedding security from design through delivery while preserving control integrity and audit defensibility.
Key Responsibilities
- Define and maintain data security architecture: data loss prevention (DLP), data classification and tagging enforcement, encryption, and data privacy governance interfaces.
- Own architectural requirements for Microsoft Purview enforcement: sensitivity labeling, auto-labeling policy design, DLP policy architecture across endpoints, email, and cloud services.
- Define data classification enforcement architecture in alignment with the Global Data Classification Policy and Global Data Protection Policy, ensuring controls scale with data sensitivity.
- Own encryption and key management architecture requirements for infrastructure-managed data, including interfaces to secrets management and enterprise key management platforms including crypto-agility and post-quantum cryptography (PQC) migration readiness for infrastructure-managed data and key material.
- Define secure data access patterns for infrastructure-managed data stores and application interfaces, preventing unauthorized access, exposure, or tampering.
- Architect DLP coverage for emerging data egress channels, including AI-enabled tooling and agentic workflows, in coordination with Enterprise Security Architecture.
- Author and maintain the security standards, reference architectures, and control requirements that govern the Secure Data domain, mapped to CSF-10 (Data Protection) and ZTMM maturity targets.
- Conduct security architecture reviews for secure data initiatives; issue dispositions, conditions, and architectural decision records traceable to ISRM governance.
- Contribute domain expertise to ZTMM maturity assessments, control gap analyses, and the security architecture roadmap.
- Serve as the dedicated architecture counterpart to the Secure Data Engineering Squad, validating feasibility and effectiveness of security controls through implementation without assuming delivery ownership.
- Define logging, telemetry, and monitoring requirements (CSF-12) for secure data services in partnership with Security Operations, which owns SIEM, detection engineering, and continuous monitoring
What You'll Bring
Bachelor’s degree in a relevant field or equivalent practical experience.
6–10 years in security architecture, security engineering, or infrastructure security with demonstrated architecture responsibility.
Experience operating in large, audit-sensitive, or regulated enterprise environments with formal governance and exception processes.
Strong understanding of zero trust architecture (NIST SP 800-207, CISA ZTMM), enterprise control frameworks, and hybrid cloud environments (Azure, AWS, GCP).
Deep hands-on architecture experience with Microsoft Purview (Information Protection, DLP), enterprise data classification programs, and encryption architecture.
Working knowledge of key management and secrets management platforms (e.g., HashiCorp Vault, cloud-native KMS/HSM), BYOK patterns, and cryptographic standards lifecycle.
Familiarity with insider risk, data egress monitoring, and DLP enforcement across endpoint, network, and SaaS channels.
Preferred Qualifications
Professional certifications such as CISSP, SABSA, or relevant cloud security certifications.
Who You'll Work With
You will join the Infrastructure Security Architecture team within Information Security Risk Management (ISRM), serving as the dedicated security architecture partner for BCG’s Secure Data Engineering Squad. In this role, you will own the governance and technical architecture requirements that protect data across loss prevention, classification enforcement, encryption, and secrets management.
You will collaborate closely with engineering, cloud, identity, infrastructure, and security teams across BCG’s global technology organization to ensure data security controls are consistently designed, implemented, and governed. You will also partner with Security Operations, Risk Management, and architecture peers to advance Zero Trust Data pillar maturity and support enterprise-wide cybersecurity initiatives.
Working within a highly collaborative, matrixed environment, you will influence technical direction, build alignment on architectural decisions, and help teams deliver secure, scalable solutions that balance business objectives, operational effectiveness, and risk management.
Additional info
At BCG, our people and relationships are at the heart of everything we do. We believe that in-person collaboration plays an important role in our culture, mentorship, and professional development.
For this role, you will generally be expected to work from a BCG office or in person with clients on a regular basis (typically around 50% of working time), depending on business needs and in line with local policies and practices.
We aim to provide a dynamic and collaborative environment that fosters connection and teamwork.
You’re Good At
Translating enterprise security standards into practical, implementable engineering requirements.
Holding architecture authority constructively: enabling delivery teams rather than blocking them, while keeping governance boundaries intact.
Communicating precisely across engineering squads, architecture peers, and senior security leadership.
Regular, Full-Time (local employment terms apply)
Boston Consulting Group is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, age, religion, sex, sexual orientation, gender identity / expression, national origin, disability, protected veteran status, or any other characteristic protected under national, provincial, or local law, where applicable, and those with criminal histories will be considered in a manner consistent with applicable state and local laws.
BCG is an E - Verify Employer. Click here for more information on E-Verify.