Quantum Cryptography Architect

Starling; Manchester; Hybrid; GBP 90,000 - 125,000; Full time

Benefits offered by this job

Holiday entitlement and birthday day

Pension scheme

Private medical insurance

Perkbox membership

Cycle to Work

Job summary

Starling in the UK is seeking a mid-to-senior Information Security Architect to lead cryptography strategy across cloud-native and on‑prem environments. You will own PQC roadmaps, crypto-inventory, and secure design across our technology stack.

Collaborating with engineers, cloud architects and security operations, you will perform threat modelling, review ADRs, and drive crypto agility while shaping Starling's resilience to future threats.

Qualifications

• Experience as an Information Security Architect or Senior Security Engineer in cloud environments.
• Proficient in PQC standards and crypto agility.
• Strong threat modeling and risk assessment capabilities.
• Excellent communication and leadership skills.
• Familiar with PCI-DSS, ISO 27001 a plus.

Responsibilities

• Architect end-to-end security for cloud-native apps and banking platforms.
• Develop PQC transition roadmap and crypto-inventory.
• Perform threat modeling and risk assessments.
• Define cryptographic management standards.
• Mentor teams on cryptographic implementations.
• Collaborate with engineers to embed security into SDLC.
• Lead secure design reviews and ADRs.

Skills

Post-Quantum Cryptography

Threat Modeling

Security Architecture

Cryptography & PKI

Communication

Tools

AWS

GCP

Kubernetes

Job description

Starling is the UK's first and leading digital bank on a mission to fix banking! Our vision is fast technology, fair service, and honest values. All at the tap of a phone, all the time.

We are about giving customers a new way to spend, save and manage their money while taking better care of the planet, which has seen us become a multi-award-winning bank that now employs over 3,000 people across our offices in London, Cardiff, Dublin, Southampton, and Manchester. Our journey started in 2014, and since then we have surpassed 3.5 million accounts with 350,000 business customers. We are a fully licensed UK bank, but at heart, we are a tech-first company, enabling our platform to deliver brilliant products.

Our technologists are at the very heart of Starling and enjoy working in a fast-paced environment that is all about building things, creating new stuff, and disruptive technology that keeps us on the cutting edge of fintech. We operate a flat structure to empower you to make decisions regardless of what your primary responsibilities may be; innovation and collaboration will be at the core of everything you do. Help is never far away in our open culture, you will find support in your team and from across the business, we are in this together!

The way to thrive and shine within Starling is to be a self-driven individual and take full ownership of everything around you: from building things, designing, discovering, to sharing knowledge with your colleagues and making sure all processes are efficient and productive to deliver the best possible results for our customers. Our purpose is underpinned by five Starling values: Listen, Keep It Simple, Do The Right Thing, Own It, and Aim For Greatness.

Hybrid model

We have a Hybrid approach to working here at Starling - our preference is that you're located within a commutable distance of one of our offices so that we're able to interact and collaborate in person. In Technology, we're asking that you attend the office a minimum of 1 day per week.

About Role & Team

The Security Architecture team at Starling is driving significant impact across the organisation, actively guiding and empowering teams across Security and the wider technology landscape. We are looking for a mid-to-senior level Information Security Architect to join our ranks.

While you will cover typical end-to-end security architecture across our modern tech stack, this role carries a strategic focus: Cryptography & Post-Quantum Readiness. As quantum computing capabilities evolve, we are looking to ramp up our Post-Quantum Cryptography (PQC) efforts. We are looking for a leader who will own the strategic design of our cloud-native and on-premise cryptography roadmaps, conduct cryptographic assessments, drive crypto-agility, and define our technical roadmap to keep Starling resilient against emerging future threats.

What you'll get to do

• Lead our Post-Quantum Strategy: Take ownership of Starling’s Post-Quantum Cryptography (PQC) initiative over the coming years; designing our crypto-inventory, evaluating PQC algorithms, and designing architectures built for cryptographic agility.
• Act as the Cryptography SME: Provide expert architecture and design guidance on Public Key Infrastructure (PKI), Hardware Security Modules (HSMs), key management, service mesh security, and transport layer protocols across our cloud environments.
• Enterprise Architecture Delivery: Architect secure, scalable solutions across AWS and GCP, translating complex security requirements into simple, pragmatic design patterns for engineering teams.
• Secure Architecture Governance: Lead and assist with secure design reviews and threat modeling initiatives, delivering actionable security guidance and continuous support to Engineering teams.
• Proof of Concept Development: Our architects enjoy a hands‑on approach. When suitable, we design and build PoC solutions for engineers to refine or draw inspiration from.
• Collaborate & Influence: Work closely with software engineers, cloud architects, and security operations to review RFCs and ADRs, conduct threat models, and embed security seamlessly into the development lifecycle without adding friction.
• Drive Thought Leadership: Serve as a trusted advisor within our growing Security Architecture team, staying ahead of industry trends, threat vectors, and regulatory standards to elevate Starling's overall security posture.

Responsibilties

• Architect end-to-end security solutions for cloud-native applications, microservices, and modern banking platforms.
• Develop and lead our Post-Quantum Cryptography transition roadmap and crypto-inventory strategy.
• Perform threat modeling and technical risk assessments on new and existing platform architectures.
• Define, document, and promote enterprise cryptographic management standards (key lifecycle, hardware security, modern cipher suites).
• Review architectural design documents, RFCs, and ADRs to ensure alignment with security guardrails and regulatory requirements.
• Mentor engineering teams and provide guidance on cryptographic implementations, securely managing secrets, and data protection at rest/in transit.
• Support the rest of the Security Architecture team with daily security architecture activities (e.g. adhoc security architecture advisory services).

• Security Architecture Experience: Proven track record in a Information Security Architect or Senior Security Engineering role designing secure, distributed systems within modern cloud environments (AWS/GCP).

• Deep Cryptography Expertise: Comprehensive practical and theoretical knowledge of symmetric/asymmetric cryptography, PKI management, digital signatures, key management systems (KMS), and HSMs.
• Post-Quantum Cryptography (PQC) Knowledge: Strong understanding of quantum computing threats to modern encryption, NIST PQC standards, hybrid key exchange, and strategies for achieving crypto-agility.
• Threat Modeling & System Design: Demonstrated ability to perform threat modeling on complex cloud-native applications, APIs, and microservices architectures (e.g. Kubernetes, ECS).
• Pragmatic Problem Solver: A firm believer that security should enable engineering speed, with the ability to design security controls that minimise developer friction.
• Communication & Collaboration: Excellent written and verbal communication skills, with a track record of distilling complex technical/cryptographic risks into clear guidance for both technical teams and senior leadership.

Desirable

• Experience in Fintech, Banking, or highly regulated cloud environments (e.g. PCI-DSS, ISO 27001, NIST guidelines).
• Demonstrated background in a highly technical role (e.g. Security Engineering, Infrastructure Engineering, Penetration Testing).
• Experience in infrastructure, application, and AI security (e.g. container security, secure code reviews, secure integration of generative AI/ML).
• Practical experience leveraging and applying the SABSA (Sherwood Applied Business Security Architecture) framework to design business-driven, risk-aligned enterprise security architectures.
• Recognised industry security certifications (e.g. SABSA, CISSP, AWS Security Specialty, or specialised cryptography credentials).

Interview process

Interviewing is a two-way process and we want you to have the time and opportunity to get to know us, as much as we are getting to know you! Our interviews are conversational and we want to get the best from you, so come with questions and be curious. In general, you can expect the below following a chat with one of our Talent Team:

• Stage 1: ~20 minute phone call with our Security Architecture Lead
• Stage 2: ~75 minute technical interview with the team
• Stage 3: ~30 minute final interview with the Security Architecture Director and CISO

We have a Hybrid approach to working here at Starling - our preference is that you're located within a commutable distance of one of our offices so that we're able to interact and collaborate in person. In Technology, we're asking that you attend the office a minimum of 1 day per week.

• 25 days holiday (plus take your public holiday allowance whenever works best for you)
• An extra day’s holiday for your birthday
• Annual leave is increased with length of service, and you can choose to buy or sell up to five extra days off
• 16 hours paid volunteering time a year
• Salary sacrifice, company enhanced pension scheme
• Life insurance at 4x your salary & group income protection
• Private Medical Insurance with VitalityHealth including mental health support and cancer care. Partner benefits include discounts with Waitrose, Mr&Mrs Smith and Peloton
• Generous family-friendly policies
• Perkbox membership giving access to retail discounts, a wellness platform for physical and mental health, and weekly free and boosted perks
• Access to initiatives like Cycle to Work, Salary Sacrificed Gym partnerships and Electric Vehicle (EV) leasing

About Us

You may be put off applying for a role because you don't tick every box. Forget that! While we can’t accommodate every flexible working request, we're always open to discussion. So, if you're excited about working with us, but aren’t sure if you're 100% there yet, get in touch anyway. We’re on a mission to radically reshape banking – and that starts with our brilliant team. Whatever came before, we’re proud to bring together people of all backgrounds and experiences who love working together to solve problems.

Starling is an equal opportunity employer, and we’re proud of our ongoing efforts to foster diversity & inclusion in the workplace. Individuals seeking employment at Starling Bank are considered without regard to race, religion, national origin, age, sex, gender, gender identity, gender expression, sexual orientation, marital status, medical condition, ancestry, physical or mental disability, military or veteran status, or any other characteristic protected by applicable law.

When you provide us with this information, you are doing so at your own consent, with full knowledge that we will process this personal data in accordance with our Privacy Notice. By submitting your application, you agree that Starling Bank will collect your personal data for recruiting and related purposes. Our Privacy Notice explains what personal information we will process, where we will process your personal information, its purposes for processing your personal information, and the rights you can exercise over our use of your personal data.