Consultant Per Diem - Security Operations Data Platform Program Architect

About Us

NYSTEC is a nonprofit technology consulting company, advising agencies, organizations, institutions, and businesses since 1996. We’re independent and vendor‑neutral, so we have our clients’ best interests  NYSTEC, we know that we succeed when individuals and teams flourish personally and professionally, so our benefits and perks support that mindset.

Serving as a security operations data platform program architect, your day‑to‑day role as a NYSTEC per diem consultant will include focusing on stakeholder engagement, campus onboarding, vendor coordination, and organizational change management across SUNY’s federated environment. You will work closely with SUNY’s cloud/security technical teams, which handle detailed platform architecture and implementation.

• Program leadership and execution (40%):
• Lead POC planning, execution, and evaluation with clear success criteria and go/no‑go recommendations
• Manage pilot campus selection, onboarding, and expansion (three campuses 10‑15 64)
• Track program metrics, including campus adoption, data ingestion reliability, cost per campus, and stakeholder satisfaction
• Deliver biweekly updates to the cross‑campus subject matter expert advisory team and monthly executive briefings to SUNY leadership
• Manage program budget, timeline, risks, and dependencies across all phases
• Establish a governance structure with clear decision rights (campus vs. system)
• Campus stakeholder engagement and change management (30%):
• Serve as primary liaison to 64 campus IT organizations and leadership teams
• Conduct campus roadshows, workshops, and training to build awareness and support
• Navigate campus resistance with empathy and strategic communication, identifying and cultivating campus champions
• Design a campus onboarding framework recognizing diversity (cloud‑native vs. on‑premises, large vs. small, compliance‑complex)
• Develop enablement materials, such as reference architectures, deployment guides, and training content
• Lead organizational change strategy for transitioning from current tools to a new platform, balancing standardization with campus autonomy
• Managed SOC integration and operational alignment (15%):
• Lead managed security operations center (SOC) vendor evaluation, selection, and integration planning
• Define SOC access patterns to centralise the data platform and service level expectations
• Validate SOC investigation effectiveness and operational workflows
• Ensure that the platform architecture serves security operations needs and translate security requirements to the technical team
• Partner with the SUNY chief information security officer on sharing threat intelligence coordinating incident response, and documenting minimum logging requirements
• Design a flexible model for supporting campus choice in its security operations approach (system SOC, campus SOC, hybrid, vendor)
• Vendor management and strategic coordination (10%):
• Coordinate with the cloud provider (Amazon Web Services [AWS], Google Cloud Platform [GCP], or Microsoft Azure) on implementing and optimizing the data lake
• Support the Crowd Strike contract negotiation strategy (expires January 2028) and coordinate integrations with Falcon Data Replicator
• Manage service level agreement (SLA) tracking, vendor performance, and the delivery of managed SOC services.
• Plan the Microsoft/Forsyte transition for 16 Sentinel campuses (expires December 2028)
• Ensure that architecture decisions preserve vendor flexibility and competitive leverage
• Develop vendor evaluation criteria and participate in negotiations and contract reviews
• Technical architecture oversight (5%):
• Understand the cloud‑native data lake architecture sufficiently to make informed program decisions
• Review designs with the technical team to ensure alignment with operational requirements
• Translate technical concepts for nontechnical stakeholders, identifying trade‑offs that require program‑level decisions
• Coordinate Crowd Strike, Tenable One, and cloud‑native source integrations between vendors and the technical team
• Develop cloud platform knowledge through certifications or training (provider determined during POC)

• A…