Senior Cybersecurity Architect — Build a U.S. Law Firm's Security Stack

Senior Cybersecurity Architect — Build a U.S. Law Firm's Security Stack

Remote, Philippines · One-month fixed-fee build with a path to ongoing work

USD $3,500 flat for a one-month Phase 1 build, plus USD $500 if you start within 5 business days and clear the day-14 milestone. Ongoing oversight is negotiated afterward, priced from the threat assessment you write.

The client: a U.S. law firm, fewer than 12 remote staff, Microsoft 365, holding Protected Health Information and privileged work product. No legacy security stack, no committee. You design from a blank page and report directly to the owner who quickly d ---------- . The firm is named to finalists once the confidentiality agreement is signed.

The money. USD $3,500 or about ₱220,000 — the upper end of the Philippine security-architect range for a month. A contractor fee, not a salary: no employer contributions, no 13th month, Philippine taxes yours.

Schedule. Fully remote, likely permanently. Your own hours plus one weekly hour with the owner, in your morning or evening. If an office opens in Metro Manila or Cebu (Makati, BGC, IT Park) — no sooner than January 2027, und ---------- — on-site is optional, never required.

Where We Are, and the Question We Most Want Answered
Today each laptop runs its own software and does its own computing. Firm data lives in cloud storage that syncs down to every machine, e.g., Google Drive, so a local index of client files stored in the cloud is on every endpoint. We need you to ensure compliant security is designed at every vulnerability.

Two decisions we need made together:
• Where computing and data should live. Harden what we have under Microsoft 365 Business Premium; move compute and data off the endpoint with Cloud PCs or virtual desktops; browser-only access on locked-down devices; or different models by role, with certain staff treated differently than other staff.

• What the firm syncs with. Whether Google Drive stays on a plan and configuration that will hold up with a signed business associate agreement, or whether we consolidate onto, e.g., SharePoint and OneDrive under the same tenant that runs our identity and email — with sync policy, external sharing controls, permissions, retention and legal hold, version history and ransomware rollback, audit-log retention, and PHI data-loss prevention all designed as one thing rather than bolted on.

We lean toward MS Business Premium or a hybrid solution and need to know whether it suffices here, where exactly it stops, what add-ons it needs, and the approximate all-in cost per seat. Tell us what you would need to know before answering. Saying, “I’m not sure but will figure it out” always beats a confident guess or wrong answer.

Phase 1 implements the model we approve. If your recommendation needs more hours than the band below, quote it and we will scope a change order rather than squeeze it. A quality deliverable always beats cut corners.

Phase 1 — The Build, 80 to 120 Hours
Think the scope is too large for one month, or priced too low? Say so in your application. That counts for you, not against you.

• Endpoint and data-location model: a written recommendation on where compute and data should live, with licensing tiers, per-seat cost, and tradeoffs stated plainly — then implementation of the approved model for Attorneys and paralegals, and another for heightened security for support staff.

• Cloud sync and storage: the platform decision above, implemented — including migration from current storage with no loss of file history, a permissions model, external sharing and link-expiry controls, sync restricted so that unmanaged devices cannot pull local copies, retention and legal-hold settings compatible with litigation obligations, version history and ransomware recovery, audit-log retention, and a signed business associate agreement with whichever provider we land on.

• Email: SPF, DKIM, DMARC — monitoring in week one, quarantine by day 14 with every legitimate third-party sender inventoried, enforcement by final acceptance unless your report gives a specific reason to hold — plus anti-phishing, BEC and impersonation protection, and outbound forwarding restrictions.

• Identity: MFA everywhere, phishing-resistant for administrators; a conditional access baseline; legacy authentication off; separate admin accounts and least-privilege roles; a break-glass account held by the owner.

• Endpoints: an Intune-or-equivalent baseline on every remote computer in both countries — full-disk encryption, EDR deployed and alerting, patch enforcement, least-privilege local administration — plus an enforceable acceptable-use and device policy and written onboarding and offboarding checklists.

• Closing deliverables: a threat assessment and risk register in plain English an attorney can act on; a written i ---------- -response plan; a runbook complete enough for a successor, which is a condition of final payment; and your scope and monthly rate for Phase 2 and ongoing oversight, with a managed detection and response recommendation.

We pay for the licensing and tooling your design requires, within a budget agreed before you build.

Phase 2 — advanced data-loss prevention, mail encryption, zero-trust refinement, and whether the firm needs a server at all — is priced from your assessment and not guaranteed.
Before any access, you sign confidentiality, work-product, and data-processing agreements with the firm directly, work only from a secure and compliant device, and hold a named administrator account that is never the only Global Administrator. We verify certifications with the issuing bodies and speak with two references first. No subcontracting, and no firm or client data into any third-party or AI service without written authorization. No exclusivity — keep your other clients, but disclose any engagement adverse to ours, i.e., competing law firms we may be opposing.

What Comes After – Ph Employer of Record following Ph Labor Law
Phase 1 is fixed-fee with no guaranteed second month. Do not leave a job for it. But a firm holding this data does not secure itself once. Ongoing work — program oversight, i ---------- response, quarterly threat assessments, vulnerability management, staff training, and vendor and third-party risk review — is paired with a managed detection and response service we pay for, so you oversee a program rather than watch a queue. If it follows, we intend to employ you through an established Philippine employer of record: employment contract, SSS, PhilHealth, Pag-IBIG, 13th month pay, statutory leave. An intention, not a promise.

Pay, in USD
Milestone
* Signed scope agreement, accepted architecture design and platform recommendation: $1,200
* Day 14 — DMARC at quarantine, MFA and conditional access live, endpoint baseline deployed: $1,300
* Final acceptance — all Phase 1 deliverables, runbook included: $1,000
* Fast-start bonus — started within 5 business days, day 14 met on time: $500

Pay is fixed in USD so will fluctuate when converted to PHP via international payment platform. Out-of-scope work is a written change order; if we cancel mid-phase, accepted milestones are paid and work in progress is paid pro rata. Full commercial terms go to shortlisted candidates.

You
• 8+ years in security, 3+ as the final word on design decisions.
• Microsoft 365 and Entra ID depth — conditional access, Defender, Intune, Purview, mail flow, DMARC taken to enforcement on a live production domain — and fluency in licensing boundaries: Business Premium versus E3 and E5, Defender for Business versus Defender for Endpoint, what needs a Purview add-on. We spend on your advice.
• Hands-on with enterprise file sync and storage at the policy level: SharePoint and OneDrive, or other similar, including sync controls, external sharing governance, retention, and a migration you have actually run.
• Windows 365, Azure Virtual Desktop, or equivalent taken to production.
• I ---------- response you can describe concretely: what happened, what you did, what changed.
• Excellent written English; half this job is explaining risk to attorneys who d ---------- from what you write.
• Able to start within 5 business days and finish Phase 1 inside one month, with reliable internet, a backup connection, backup power, and a habit of documenting without being asked.
• Preferred: current CISSP, CISM, CCSP, OSCP, GIAC, or Microsoft security certification; legal, medical, or financial client data; NIST CSF, CIS Controls, or ISO 27001; the Philippine Data Privacy Act.

Apply
Subject line: SENTINEL — Security Architect. Without it, we do not read it.

1. CV, certifications with numbers and expiry dates, and two references for the finalist stage.

2. Under 300 words: one architecture you designed and implemented end to end — what was exposed, what you built, how you knew it worked.

3. Under 250 words: fewer than 12 remote staff in two countries, PHI in cloud storage syncing full local copies to every laptop, Microsoft 365 for mail and identity. What do you change first, what platform do the files end up on, and what would you need to know before committing to that answer? Include a rough all-in cost per seat.

4. Under 100 words: is Phase 1 achievable in one month at 80 to 120 hours? If not, what would you cut or move to Phase 2, and why?

5. Earliest start date, location, internet and power setup, confirmation that a weekly live call in your morning or evening works, and a rough monthly range for ongoing oversight.

Finalists complete a short written exercise on a synthetic environment — paid whether or not we engage you — then a video
call with the owner, where the firm is identified and the agreements are signed. We review applications as they arrive.