Tomorrow’s health is… Tackling challenges no one else can.

McKesson is an impact-driven, Fortune 10 company that touches virtually every aspect of healthcare. We are known for delivering insights, products, and services that make quality care more accessible and affordable. Here, we focus on the health, happiness, and well-being of you and those we serve – we care.

What you do at McKesson matters. We foster a culture where you can grow, make an impact, and are empowered to bring new ideas. Together, we thrive as we shape the future of health for patients, our communities, and our people. If you want to be part of tomorrow’s health today, we want to hear from you.

Principal Cybersecurity Architect

Job Level: Principal Architect
Reports To: Sr. Director, Strategy, Architecture & Data Services
Type: Full-time

Role Summary

The Principal Cybersecurity Architect defines and governs the enterprise cybersecurity architecture vision, strategy, and standards, ensuring cohesive, resilient, and compliant security across all domains. This role directs architecture plans for transformation and risk mitigation, partnering closely with executive leadership to align security investments to business outcomes and technology roadmaps. The Principal Architect anticipates disruptive security technologies and evolving threat environments, continuously strengthens the security architecture and governance frameworks, and ensures the ethical protection and use of information assets. They build and sustain a high-performing architecture community, represent the organization externally, and ensure the cybersecurity architecture delivers measurable business value and risk reduction.

Key Responsibilities

Strategy & Governance

• Define and govern the enterprise-wide cybersecurity architecture vision, principles, standards, patterns, and reference architectures (e.g., Zero Trust, cloud-native, data-centric security).
• Direct the creation and execution of security architecture roadmaps for transformation initiatives (cloud migration, network modernization, identity & access modernization, application security), with clear milestones and KPIs.
• Lead development and continuous improvement of security governance frameworks, architecture review boards (ARBs), control lifecycles, decision rights, and exception processes.
• Ensure integration and alignment across all cybersecurity domains (IAM, network & perimeter, endpoint, application, data security, cloud, OT/IoT, threat management, resilience) for consistent risk reduction and compliance.

Executive Partnership & Business Alignment

• Partner with executive leadership (CISO, CIO/CTO, Enterprise Architecture, Risk, Legal, Data & AI leaders) to align cybersecurity strategy to business and technology goals.
• Translate business drivers into actionable architecture outcomes and funding proposals, quantifying value, risk reduction, and cost to serve.
• Represent the organization externally in security architecture forums; influence industry standards and bring external best practices back into the enterprise.

Technology Foresight & Threat Anticipation

• Anticipate and shape response to disruptive security technologies (e.g., passwordless, confidential computing, post-quantum crypto, secure access service edge [SASE], AI security) and emerging threats.
• Establish horizon-scanning and threat-informed architecture practices, ensuring architectures remain defensible under evolving adversary TTPs.

Information Protection & Ethics

• Lead protection, classification, and ethical use of information assets, enforcing data security controls (classification, DLP, encryption, tokenization, privacy-by-design).
• Drive ‘security by design’ in product development and data platforms; embed guardrails for responsible AI and model security.

Delivery & Enablement

• Own the security architecture backlog and prioritize across portfolios, partnering with Product/Platform Owners and Enterprise Architects.
• Guide solution architectures for critical programs; mentor and coach solution/security architects and engineers.
• Build and sustain a high-performing architecture community, including guilds/chapters, playbooks, reusable patterns, and communities of practice.

Metrics & Outcomes

• Ensure cybersecurity architecture delivers measurable business value: reduced residual risk, lower incident probability/impact, improved control effectiveness, reduced TCO/complexity, accelerated delivery, and audit readiness.
• Publish executive dashboards: architecture conformance (pattern adoption), risk posture changes, control coverage/gaps, remediation velocity, and modernization progress.

At McKesson, we care about the well-being of the patients and communities we serve, and that starts with caring for our people. That’s why we have a Total Rewards package that includes comprehensive benefits to supportphysical, mental, and financial well-being. Our Total Rewards offerings serve the different needs of our diverse employee population and ensure they are the healthiest versions of themselves.

As part of Total Rewards, we are proud to offer a competitive compensation package at McKesson. This is determined by several factors, including performance, experience and skills, equity, regular job market evaluations, and geographical markets. The pay range shown below is aligned with McKesson's pay philosophy, and pay will always be compliant with any applicable regulations.In addition to base pay, other compensation, such as an annual bonus or long-term incentive opportunities may be offered.

Our Base Pay Range for this position

McKesson has become aware of online recruiting-related scams in which individuals who are not affiliated with or authorized by McKesson are using McKesson’s (or affiliated entities, like CoverMyMeds or RxCrossroads) name in fraudulent emails, job postings or social media messages. In light of these scams, please bear the following in mind:

McKesson Talent Advisors will never solicit money or credit card information in connection with a McKesson job application.

McKesson Talent Advisors do not communicate with candidates via online chatrooms or using email accounts such as Gmail or Hotmail. Note that McKesson does rely on a virtual assistant (Gia) for certain recruiting-related communications with candidates.

McKesson job postings are posted on our career site: careers.mckesson.com.