Lead Security Architect

Department for Environment, Food and Rural Affairs; New York; On-site; GBP 90,000 - 130,000; Full time

Job summary

Defra seeks an experienced Lead Security Architect to embed secure-by-design principles into critical national infrastructure and public services. You will lead threat modelling, provide architecture guidance, and partner with delivery teams to ensure security by design across the department.

With deep expertise in threat modelling, risk frameworks, and enterprise security architecture, you will write authoritative documentation and scale processes using automation and tooling.

Qualifications

• Proven experience in agile/project delivery environments.
• Deep expertise in threat modelling and risk management frameworks (STRIDE, PASTA) and secure system design.
• Proven track record writing high-quality guidance documentation and standards for enterprise security architecture.
• Experience using IriusRisk or similar platforms for threat modelling.

Responsibilities

• Identify threats by mapping data flows, entry points, and system architecture to uncover security gaps.
• Collaborate with architects, product managers and delivery teams to embed secure-by-design standards.
• Evaluate and apply frameworks (STRIDE, PASTA) to quantify and prioritise risks.
• Document threat lifecycles and develop tooling to scale threat modelling processes.

Skills

Threat modelling

Risk management

Secure system design

Agile delivery

Documentation

Tools

IriusRisk

Job description

Bristol, Newcastle-upon-Tyne, Reading, Warrington, York

Job Summary

Defra is the UK government department responsible for safeguarding our natural environment, supporting our world-leading food and farming industry, and sustaining a thriving rural economy. Our broad remit means we play a major role in people's day-to-day life, from the food we eat, and the air we breathe, to the water we drink.

Digital, Data, Technology and Security (DDTS) is the trusted team for digital across the entire Defra Group.

We have around 1000 colleagues across DDTS and our ambition is to make it easier and faster than ever for people to interact with Defra. If you are ready to drive innovation and push boundaries, we want to hear from you. Join us and together we will create a great place for living, and a green and healthy future for all.

Find Out More About DDTS

Defra digital, data and technology blog

LinkedIn

Defra Jobs

We are Government Digital and Data Candidate Information Pack V3 - 1

Job Description

Defra is looking for an experienced Lead Security Architect to join our Digital, Data, Technology and Security teams. In this role, you will embed "secure-by-design" principles into critical national infrastructure and public-facing services. You will lead our threat modelling capabilities, provide actionable architecture guidance, and partner directly with delivery teams to ensure Defra’s services are secure by design.

Person specification

Responsibilities

Identify Threats:

• Map data flows, entry points, and system architecture to uncover and analyse potential security gaps across complex environments.
• Build actionable security controls and mitigation strategies to lower identified risks to acceptable levels.

Collaborate Cross-Functionally

• Work directly with solution architects, product managers and project teams to embed secure-by-design standards throughout the delivery lifecycle.

Evaluate & Apply Frameworks

• Apply structured methodologies (such as STRIDE or PASTA) to quantify, categorise, and prioritise architectural risks effectively.

Document And Automate

• Maintain complete threat lifecycle records and develop automation, scripts, or tooling to scale threat modelling processes across the department.
• Author clear, authoritative documentation to support threat modeling functions and internal ways of working.

Skills And Experience

• Proven experience working directly within agile/project delivery environments alongside multidisciplinary software and infrastructure teams.
• Deep expertise in threat modelling, risk management frameworks (STRIDE, PASTA, or similar), and secure system design.
• Proven track record of writing high-quality guidance documentation and standards for enterprise security architecture.
• Experience using, managing and configuring platforms such as IriusRisk for automated and manual threat modelling.