Information Security Architecture & Engineering Lead

PCI Pal; United Kingdom; Hybrid; GBP 90,000 - 130,000; Full time

Benefits offered by this job

25 days holiday

Medical insurance

Dental insurance

Optical insurance

Office and home option

EV scheme

Work from anywhere 2 weeks/year

Training opportunities

Team events

Wellbeing support

Job summary

PCI Pal is seeking an Information Security Architecture & Engineering Lead to own cloud security, secure SDLC, and security automation across Engineering, Product and Pre-Sales.

You will drive threat modelling, CNAPP remediation, and set guardrails aligned to PCI DSS and ISO standards while collaborating with offshore teams and stakeholders.

Qualifications

• Extensive cloud security architecture experience (AWS and Azure) with IAM, network segmentation and secrets/KMS management.
• Hands-on DevSecOps experience: CI/CD security, Infrastructure-as-Code scanning, and policy-as-code.
• Strong coding capabilities in Python and C#/.NET; familiarity with PowerShell, Bash and REST APIs.
• Experience building security automation, API integrations, test harnesses or internal engineering tools with secure coding practices.
• Threat-modelling for cloud workloads at design stage, not post-deployment.
• Knowledge of PCI DSS v4.0.1 and ISO/IEC 27001:2022; ISO 42001:2023 is a bonus.
• Experience triaging findings from CNAPP or cloud security posture tools.
• Technical oversight to offshore/distributed engineering teams; runbook design & QA.
• Strong stakeholder communication and documentation skills.
• AI/LLM security testing experience (OWASP LLM Top 10, prompt injection).
• Familiarity with Microsoft 365 E5 security stack (Entra ID, Defender, Intune) for Zero-Trust investments.
• Container/Kubernetes security experience.
• Relevant certifications: CISSP, CCSP, AWS Certified Security Specialty; PCI DSS Level 1.

Responsibilities

• Own architecture review and sign-off for all new AWS production changes, incl. IAM design and network segmentation.
• Threat-model new cloud services and workloads before go-live.
• Lead remediation design for CNAPP findings with risk-based requirements.
• Set forward-looking security architecture patterns and guardrails ahead of Engineering's roadmap.
• Own CI/CD security gates and IaC scanning; partner with Development Team.
• Develop security automation and tooling using Python and C#/.NET; use PowerShell/Bash where needed.
• Review secure application code; provide proof-of-concept code and remediation examples.
• Deliver secure SDLC guidance via central advisory model and design reviews.
• Extend coverage to container and API security as the deployment scales.
• Provide security support for AI/ML security testing and vendor control claims.
• Act as central security voice in customer-facing pre-Sales and product design discussions.
• Maintain design review calendar and RACI with Engineering, Product and Pre-Sales.
• Lead joint threat-modelling cycles for major product changes.
• Contribute technical risk inputs to GRC risk register and SoA; report to CISO.

Skills

Cloud security architecture

AWS

Azure

IAM design

DevSecOps

CI/CD security

IaC scanning

SAST

Python

C#/.NET

PowerShell

Bash

REST APIs

Security automation

Threat modelling

PCI DSS

ISO 27001

CNAPP

Cloud security posture tooling

Offshore team oversight

Stakeholder comms

Documentation

AI/LLM security testing

OWASP LLM Top 10

Entra ID/Defender/Intune

Kubernetes security

Container security

CISSP

CCSP

AWS Certified Security Specialty

PCI DSS Level 1

Tools

PowerShell

Bash

REST APIs

Job description

The Information Security Architecture & Engineering Lead forms the technical heart of PCI Pal's Information Security function. The role owns cloud architecture review, DevSecOps and secure SDLC practice, security automation and tooling, and security architecture strategy for the organisation, replacing reactive, post-deployment triage with design-stage security input across Engineering, Product and Pre-Sales.

Job requirements

• Demonstrable and considerable experience in cloud security architecture (AWS essential and Azure), including IAM design, network segmentation, and secrets/KMS management.
• Hands-on DevSecOps experience: CI/CD pipeline security, Infrastructure-as-Code scanning, and policy-as-code.
• Strong hands-on software development and scripting capability, including Python and C#/.NET, with the ability to read, review and write secure production-quality code; familiarity with PowerShell, Bash, REST APIs and common software development tooling.
• Experience building security automation, API integrations, test harnesses or internal engineering tools, using source control, peer review, testing and secure coding practices.
• Experience threat-modelling applications and cloud workloads at the design stage, not just reviewing them after deployment.
• Working knowledge of PCI DSS v4.0.1 and ISO/IEC 27001:2022; familiarity with ISO/IEC 42001:2023 is an advantage.
• Experience triaging and remediating findings from a CNAPP or cloud security posture tool.
• Experience providing technical oversight to an offshore or distributed engineering team, including runbook design and quality assurance.
• Strong stakeholder communication skills, able to advise Engineering, Product and Pre-Sales credibly.
• Extremely strong documentation skills.
• Experience with AI/LLM security testing (OWASP LLM Top 10, prompt injection, model/vendor risk assessment).
• Familiarity with the Microsoft 365 E5 security stack (Entra ID, Defender for Endpoint, Intune), given PCI Pal's existing Zero-Trust investment.
• Container/Kubernetes security experience.
• Relevant certification: CISSP, CCSP, AWS Certified Security Specialty, or equivalent.
• Experience operating within a PCI DSS Level 1 service provider or merchant environment.
• Prior experience transitioning a function from reactive/operational delivery to an architecture- and engineering-led model.

Job responsibilities

Cloud Security & Architecture

• Own architecture review and sign-off for all new AWS production changes, including network segmentation, IAM design, and KMS/secrets management etc.
• Threat-model new cloud services and workloads before go-live, rather than reviewing them after deployment.
• Own remediation design, not just triage, for CNAPP and associated cloud security service findings, including closing current findings based upon risk classification and associated requirements.
• Set forward-looking security architecture patterns and guardrails ahead of Engineering's roadmap, not behind it.

DevSecOps & Secure SDLC

• Own CI/CD security gates and Infrastructure-as-Code scanning (e.g. SAST and successor tooling), working jointly with Development Team.
• Develop and maintain security automation, integration and validation tooling using Python and C#/.NET, with appropriate use of PowerShell, Bash and relevant APIs/SDKs.
• Review security-relevant application code and engineering patterns, and produce proof-of-concept code, test harnesses and remediation examples where required.
• Provide secure SDLC guidance to the Engineering function through the central advisory model, design reviews, sign-off gates, and scheduled sessions.
• Extend coverage into container and API security as the function's remit grows (Phase 3 of the deployment plan).

AI & Emerging Risk

• Provide technical engineering support to the AI Security & Governance function for LLM/model security testing (OWASP LLM Top 10 etc.), including scripted test harnesses and repeatable validation tooling, where execution capacity is needed.
• Support technical validation of AI/cloud vendor control claims (e.g. redaction testing, data flow verification) where risk warrants it, alongside AI Security & Governance.

Central Advisory to Engineering, Product & Pre-Sales

• Provide the technical security voice in customer-facing pre-Sales conversations and Product design discussions, on a scheduled and on-request basis.
• Maintain the design review calendar and RACI agreed with Engineering, Product and Pre-Sales, explicitly a central advisory relationship, not a placement or embedded model.
• Lead joint threat-modelling cycles for major product changes.

Governance & Reporting

• Provide technical risk input into Information Security GRC's risk register and Statement of Applicability, rather than GRC compiling technical risk independently.
• Report progress against the Target Operating Model roadmap to the Information Security Project Manager & CISO.

• 25 days holiday, rising to 28 days per annum with length of service
• Medical, dental and optical insurance cover
• Option to either work in our Ipswich office, or from home (or both!)
• An exciting and flexible working environment surrounded by friendly and committed co-workers
• Electric Vehicle Scheme incentive
• “Work from anywhere” 2 weeks per year policy
• Reward, benefits and wellbeing hub (offering support, discounts, cashback and savings)
• Training and development opportunities
• Ad-hoc team events, incentives and competitions