Principal IT Security Architect

Say hello to opportunities. If you’re looking to be part of what’s next in communication, you’re in the right place. At RingCentral, we believe the best customer experiences happen when humans and AI work together. Our agentic voice AI portfolio—AIR, AVA, and ACE—brings together automation, assistance, and insights across the entire conversation lifecycle. The result? More seamless, intelligent experiences for businesses everywhere. With $2.5B+ in ARR and $250M invested in R&D annually, we’re building the future of AI-powered business communications. RingCentral IT is hiring a deeply technical Principal Security Architect to determine whether our enterprise, cloud, identity, network, application, and data controls will withstand a capable modern attacker—and to prove it with evidence.This is not a governance-only or advisory role. You will live inside the admin consoles of Okta, Zscaler, Google Workspace, and Microsoft 365, reconstruct how our environment and security tools are configured, challenge inherited assumptions and exceptions, identify exploitable attack paths, and personally architect, prototype, automate, and drive durable fixes into production You will combine an adversary’s mindset with disciplined defensive engineering. You should think in attack paths and blast radius rather than control checklists, and be equally comfortable running a token-theft or consent-phishing simulation against our own tenants and then writing the Conditional Access policy, Okta authentication policy, or Drive sharing restriction that kills it. What You Will Own Identity as the security perimeter (Okta). End-to-end review and hardening of our Okta tenant: global session and app-level authentication policies, MFA factor strength and phishing-resistant enrollment (FastPass / WebAuthn), device trust, admin role delegation and standing-privilege reduction, API token and service-app scope hygiene, SCIM lifecycle provisioning and — critically — deprovisioning, Okta Workflows, ThreatInsight, and System Log streaming into our SIEM. You will hunt shadow admins, orphaned integrations, over-scoped OAuth grants, and legacy authentication paths. Zero trust network access (Zscaler). Architecture and configuration review across ZIA and ZPA: SSL inspection coverage and the bypass list (where real exposure usually hides), URL and cloud-app control, DNS and firewall policy, inline DLP, sandboxing, ZPA application segments and access policies scoped to least privilege, posture profiles, App Connector and Browser Access configuration, Client Connector forwarding profiles and PAC logic, and admin RBAC on the Zscaler tenant itself. SaaS data sharing and exposure (Google Workspace + Microsoft 365 / OneDrive / SharePoint). Exhaustive audit and remediation of external sharing: link-sharing defaults and expiry, target audiences, shared drives and site-level overrides, guest and unmanaged-device access, sensitivity labels and Purview / Google DLP rules, Entra ID Conditional Access, third-party OAuth app consent and API access controls, service account key sprawl and domain-wide delegation, and Alert Center / Defender for Cloud Apps signal quality. You will quantify how much company data is currently shared to “anyone with the link” — and then reduce it. Adversary-led validation. Design and run authorized, scoped tests against our own environment: adversary-in-the-middle session hijacking, MFA fatigue and downgrade paths, OAuth consent phishing, help-desk social-engineering resistance, SaaS-to-SaaS integration abuse, and identity attack-path mapping. Translate every finding into a specific configuration change with an owner and a date, then purple-team the result to confirm detection actually fired. Architecture, standards, and evidence. Set the target-state reference architecture for identity and SaaS security, define hardening baselines against CIS Benchmarks, CISA SCuBA, and NIST SP 800-207, instrument continuous configuration-drift detection, and produce the evidence auditors, customers, and executives ask for. You will brief the CIO and security leadership on residual risk in plain language. Every material finding must result in a root-cause analysis, durable remediation, accountable owner, deadline, compensating control when necessary, and evidence that the fix worked. REQUIRED QUALIFICATIONS 10+ years in security engineering or architecture, a substantial portion of it hands-on-keyboard in production. Certifications do not substitute for demonstrated configuration depth. Expert-level, in-console administration of Okta — you can explain policy evaluation order, the difference between a global session policy and an app authentication policy, and how you would detect a maliciously created app integration. Production experience administering Zscaler ZIA and ZPA, including the operational tradeoffs of SSL inspection, bypass exceptions, and least-privilege application segmentation. Deep working knowledge of both Google Workspace Admin and Microsoft 365 / Entra ID administration — specifically the sharing, external-collaboration, OAuth app-consent, and DLP surfaces. Demonstrated offensive capability against identity and SaaS environments. You have found real, exploitable misconfigurations, not just reported scanner output. Comfort with tooling such as BloodHound / AzureHound, ROADrecon, GraphRunner, and Burp Suite. Fluency in SAML, OIDC, OAuth 2.0, and SCIM — and the specific ways each is abused. Working knowledge of MITRE ATT&CK, including the cloud and SaaS matrices. Automation ability: Python or PowerShell against the Okta, Microsoft Graph, Google Admin SDK, and Zscaler APIs. This role is not survivable by clicking through consoles alone. The judgment to push a change through change control, quantify user-experience impact, and defend the decision to a skeptical business owner. You will be told “that will break workflows.” You need to be right, and you need to bring the data. PREFERRED OSCP, GPEN, GCPN, GWAPT, or CRTO; Okta Certified Administrator or Consultant; Zscaler ZIA/ZPA certification. CISSP or CCSP is welcome but is not what we are screening for. Experience deploying an SSPM or CASB platform (Obsidian, AppOmni, Netskope, Defender for Cloud Apps) to automate posture review at scale. Experience securing AI and agentic tooling: OAuth scopes granted to AI assistants, data-access boundaries, and enterprise copilot / agent deployments. Detection engineering against identity telemetry in a SIEM (Splunk, Sentinel, or equivalent), and prior work in a SOX or SOC 2 audited environment. HOW WE WILL EVALUATE YOU Expect a practical loop, not a trivia quiz: a live walkthrough of how you would audit a tenant you have never seen, a written attack-path analysis of a realistic misconfiguration scenario, and a session where you defend a hardening recommendation against business pushback. Come prepared to discuss a specific misconfiguration you personally found and closed — and what it would have cost had you not. What we offer: Comprehensive medical, dental, vision, disability, life insurance Health Savings Account (HSA), Flexible Spending Account (FSAs) and Commuter benefits 401K match and ESPP Paid time off and paid sick leave Paid parental and pregnancy leave Family-forming benefits (IVF, Preservation, Adoption etc.) Emergency backup care (Child/Adult/Pets) Employee Assistance Program (EAP) with counseling sessions available 24/7 Free legal services that provide legal advice, document creation and estate planning Employee bonus referral program Debt refinancing assistance Employee perks and discounts program RingCentral’s work culture is the backbone of our success. And don’t just take our word for it: we are recognized as a Best Place to Work by BuiltIn, the Top Work Culture by Comparably and hold local BPTW awards in every major location. Bottom line: We are committed to hiring and retaining great people because we know you power our success. About RingCentral RingCentral is a global leader in agentic voice AI–powered business communications, delivering an integrated platform for business phone, SMS, contact center, workforce engagement management, video collaboration, and messaging. As the communications layer connecting businesses and customers, RingCentral is the front door of business communication and is in the advantageous position to apply AI at every phase of the conversation journey — before, during, and after each interaction. Our agentic AI portfolio includes autonomous voice-first AI agents that automate calls, assist in the moment, and analyze every interaction – enabling businesses to work smarter, respond faster, and connect more meaningfully with their customers. Visit to learn more. RingCentral is an equal opportunity employer that truly values diversity. We do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status. We are committed to providing reasonable accommodations for individuals with disabilities during our application and interview process. If you require such accommodations, please click on the following link to learn more about how we can assist you. If you are hired in Belmont, CA, the compensation range for this position is between $ 184,600 and $225,100 for full-time employees, in addition to eligibility for variable pay, equity, and benefits. Benefits may include, but are not limited to, health and wellness, 401k, ESPP, vacation, parental leave, and more! The salary may vary depending on your location, skills, and experience.