Job Description

As a Security Architect, you'll partner with government, financial services, and private sector clients to design security solutions that address their most complex digital risks. You'll translate threat landscapes, compliance obligations, and business constraints into practical security architectures, working across the full engagement lifecycle, from threat modelling, security options analysis, through to facilitating design sessions with delivery teams and presenting recommendations to architecture review boards and senior stakeholders.

Whether that's defining a zero-trust approach for a government department, designing security controls for a bank's cloud migration, or guiding development teams through secure-by-design decisions, you'll bring both depth and pragmatism. Your background in cloud security, application security, and public sector compliance means clients can trust your advice on what works in enterprise environments.

You'll join our central architecture practice alongside experienced Technology Principals and Solution Architects. Security in delivery teams is often under-served; your role is to change that, not through gates and sign-offs, but by embedding security thinking early and keeping it there. That includes guiding and upskilling delivery teams on secure-by-design practices, helping engineers and product managers build security literacy without slowing down delivery.

Qualifications

Essential Requirements

You'll have designed and validated security architectures for enterprise-scale programmes, across cloud platforms, application security, identity and access management, and system integration. You can point to successful outcomes and take clear ownership of the security design decisions that got there.

Cloud and application security; experience securing workloads on AWS and/or Azure, including network segmentation, IAM, encryption, secrets management, and security monitoring. You understand AppSec practices including secure SDLC, SAST/DAST tooling, API security, and container security in agile delivery contexts.

Experience directly working with clients and senior stakeholders to assess risk, facilitate threat modelling, and build consensus around security approaches. You communicate clearly with both technical teams and non-technical leadership.

Highly Desirable

GOV.UK and public sector compliance: experience working within GOV.UK digital standards, GDS service assessments, NCSC guidance, and UK government security classifications (Official, Secret). Familiarity with DSP Toolkit or equivalent assurance frameworks.

Financial services security: experience designing controls for regulated financial environments, including FCA/PRA expectations, PCI-DSS, and secure integration patterns for core banking or payment systems.

Security frameworks and standards: working knowledge of NIST CSF, ISO 27001, CIS Controls, or SABSA. Holds or is working towards CISSP, CISM, CCSP, or equivalent.

GenAI security: experience assessing and mitigating risks in AI/ML solution architectures, including data exposure, prompt injection, model supply chain, and output integrity.

• Additional Information