Lead Security Architect

LA International; Greater London; On-site; GBP 90,000 - 140,000; Full time

Job summary

LA International is seeking a Lead Security Architect to provide senior security architecture leadership across the public sector programme in the UK. You will translate strategy, policy and risk appetite into pragmatic architectural direction, patterns and controls to ensure secure, resilient systems.

You will lead security architecture across complex services, embed secure-by-design practices, and influence senior stakeholders and suppliers to balance risk with delivery needs.

Qualifications

• Extensive practical experience in security architecture within complex technology environments.
• Broad knowledge of enterprise and solution architecture, cyber security principles and security engineering.
• Familiarity with cloud/hybrid architectures, IAM, data protection and security standards.

Responsibilities

• Lead the development and evolution of security architecture across major services and programmes.
• Define security architecture principles, patterns and guardrails to enable secure design.
• Embed secure-by-design principles across architecture, engineering and delivery lifecycles.
• Provide authoritative security advice on significant product and architectural decisions.

Skills

Security architecture

Threat modelling

Cloud security

Identity and access management

Application security

API security

Security governance

Data protection

Incident response

Vulnerability management

Job description

The Lead Security Architect provides senior security architecture leadership across the public sector programme.

The role is accountable for defining and assuring security architecture, ensuring that security risks are understood and appropriately managed, and embedding secure-by-design principles throughout the digital product engineering lifecycle.

Working across architecture, engineering, cyber security, delivery, information governance and business teams, the Lead Security Architect translates organisational security strategy, policy and risk appetite into pragmatic architectural direction, patterns and controls.

The role provides authoritative security advice on significant product and architectural decisions and influences senior stakeholders, suppliers and technical teams to ensure that solutions remain secure, resilient and proportionate to the risks they manage.

Key responsibilities

Security architecture leadership

• Lead the development and evolution of security architecture across significant services, platforms and programmes.
• Define security architecture principles, patterns, standards and guardrails that enable teams to design and deliver secure systems consistently.
• Establish the security architecture direction for complex technology initiatives and ensure that individual solution designs align with wider organisational strategy.
• Ensure security considerations are incorporated from the earliest stages of architecture and design rather than being applied as a later assurance activity.
• Provide technical leadership across complex security architecture issues where there may be competing business, technology, delivery and security considerations.

Secure-by-design

• Champion and embed secure-by-design principles throughout architecture, engineering and delivery practices.
• Ensure that threats, vulnerabilities and security risks are identified and considered throughout the system lifecycle.
• Guide teams in the appropriate use of security architecture techniques including threat modelling, security design reviews, data-flow analysis and architectural risk assessment.
• Ensure appropriate controls are designed across areas such as identity and access management, application security, APIs, infrastructure, cloud services, networks, data protection, secrets management, logging, monitoring and resilience.
• Promote proportionate security controls based on risk rather than prescriptive implementation of controls.

Security risk and assurance

• Provide authoritative architectural advice on security risks affecting systems, services and programmes.
• Evaluate whether proposed architectures and technology choices provide appropriate protection for the confidentiality, integrity and availability of information and services.
• Identify significant architectural security risks, clearly communicate their potential impact and recommend appropriate treatment.
• Support informed risk decisions by explaining the architectural implications, options, trade-offs and residual risks.
• Work with security assurance, cyber security and governance functions to ensure that architectural decisions and security controls support organisational policies, regulatory obligations and recognised security standards.
• Provide security architecture leadership within architecture governance and design assurance processes.
• Review significant solution designs and provide proportionate, evidence-based security recommendations.
• Identify architectural decisions that require wider organisational agreement and ensure they are escalated to the appropriate governance authority.
• Define reusable reference architectures, patterns and security guidance that reduce duplicated design effort across delivery teams.
• Challenge proposed designs where security risks are not adequately understood or addressed while helping teams identify practical alternatives.

Strategic influence

• Influence the App strategy from a security architecture perspective.
• Translate changes in technology, cyber threats, regulation and industry practice into implications for organisational architecture.
• Contribute to the App product roadmap and strategic decisions where security architecture is a significant consideration.
• Identify systemic or recurring security architecture issues and initiate improvements that address their underlying causes.
• Balance security requirements with usability, accessibility, operability, cost and delivery considerations.

Stakeholder leadership

• Build effective relationships with senior leaders, architects, engineers, security specialists, delivery teams and external suppliers.
• Communicate complex security issues clearly to both technical and non-technical audiences.
• Influence stakeholders where security requirements conflict with delivery priorities or existing architectural approaches.
• Facilitate security architecture discussions across organisational and supplier boundaries.
• Represent security architecture in senior technical and governance forums.

Professional and technical leadership

• Provide leadership and direction to security architects and other technical specialists.
• Coach and mentor architects and engineers in security architecture and secure-by-design practices.
• Promote consistent architectural practices and raise security architecture capability across the organisation.
• Support communities of practice and contribute to organisational architecture standards, methods and guidance.
• Maintain awareness of developments in cyber security, architecture, cloud platforms and emerging technologies and assess their relevance to the organisation.

Accountability

• The Lead Security Architect operates with substantial autonomy and is accountable for security architecture decisions within the App programme.
• The role is expected to make and influence high-level technical decisions, establish architectural direction and provide authoritative recommendations to senior stakeholders.
• The role may delegate detailed architectural activities while retaining accountability for the overall quality, consistency and effectiveness of the security architecture.
• Issues that materially affect organisational strategy, risk appetite or enterprise-wide policy are escalated to the appropriate senior architecture, security or governance authority

Knowledge and experience

The role requires substantial practical experience of security architecture within complex technology environments, together with broad knowledge across areas including:

• enterprise and solution architecture
• cyber security principles and security engineering
• cloud and hybrid architectures
• identity and access management
• application and API security
• infrastructure and network security
• data protection and information security
• threat modelling and security risk assessment
• security monitoring and logging
• vulnerability management
• resilience and incident response
• security architecture frameworks, standards and patterns
• relevant legislation, regulation and industry standards.

The Lead Security Architect understands how these areas interact and can use that knowledge to make architectural decisions where requirements, risks and stakeholder priorities may conflict.