Security Architect - Data

JD; United Kingdom; On-site; GBP 80,000 - 100,000; Full time

Job description

Role Purpose:

We are looking for an experienced Data Security Architect to join our growing Information Security team.

Reporting to the Global Head of Security Strategy, Architecture & Engineering and working closely with IT technology and architecture functions, you will develop and implement information security architecture and technology solutions to ensure information security and compliance requirements of the organisation as we go through our Digital Transformation and modernisation and beyond.

As a Data Security Architect, you will possess in-depth knowledge of a broad range of information security controls to protect various data stores, both on-premises and in the cloud.

The Data Security Architect is responsible for developing and executing a global data security strategy, ensuring the protection of sensitive information across the JD Group.

Key Responsibilities:

1. Implement and lead the Data Security Architecture capability across JD Sports, formalising principles through reference architectures, diagrams, and procedures.
2. Research, evaluate, and implement data security technologies, process and services to reduce cyber risk and enhance performance.
3. Develop and maintain a global data security strategy, including encryption, tokenization, anonymization, and Data Loss Prevention (DLP).
4. Ensure information security aspects of applications and services safeguard JD Sports' data, IP, customers, and brand reputation.
5. Provide security guidance to business technology teams, ensuring security is integrated from the outset of projects throughout their lifecycle.
6. Work with Data Privacy Office to ensure adequate protection of sensitive information.
7. Translate security requirements into architectural blueprints and patterns, balancing risk, budget, and operational challenges.
8. Ensuring compliance with regulatory standards such as GDPR and PCI DSS.
9. Provide subject matter expertise and assess security measures, recommending improvements in collaboration with IT teams.
10. Build and maintain relationships with technology vendors and business partners.
11. In conjunction with JD's Managed Detect and Respond services, develop and maintain incident response plans for data security breaches, ensuring quick and effective resolution.

Qualifications and Skills:

1. Professional certifications in Information Security or Cybersecurity (e.g. Certified Information Systems Security Professional, Certified Information Security Manager).
2. 5+ years of IT security experience working on data security enforcement.
3. Strong understanding of security frameworks like NIST, ISO 27001, and CIS Controls, and their application to enhance security and ensure compliance.
4. Proven expertise in designing and implementing data security controls in geographically dispersed and hybrid cloud environments.
5. Hands-on experience with modern enterprise-level data protection tools, including Data Loss Prevention (DLP), Digital Rights Management (RMS), data encryption/tokenization, and data discovery.
6. Strong familiarity with Microsoft security solutions, such as AD RMS, Azure RMS, and Microsoft Purview for data governance, classification, and compliance monitoring.
7. In-depth knowledge of PKI, including certificate lifecycle management, encryption protocols, and secure key management practices.
8. Ability to lead and execute large, complex projects related to data security (e.g. introduction of a global DLP solution, replacement of a PKI environment).
9. Considerable technical writing proficiency, oral presentation skills, problem solving and decision-making skills.
10. Experience in using architecture methodologies such as TOGAF and SABSA.
11. Practical experience in Agile/DevOps organizations and cultures.