Security Architect (OT, IT, Network and Physical)

Expleo UK LTD; Bristol; On-site; GBP 70,000 - 110,000; Full time

Job summary

Expleo UK is seeking a hands-on security architecture lead to define and own the security architecture for a major UK defence maritime programme. You will work across OT, IT, networks and physical security, guiding naval architects and system engineers to achieve fail-safe, minimum-risk design even with a compromised remote link.

You will produce architectural evidence for design reviews and align with the Secure by Design lead’s Security Management Plan, supporting supplier and interface

Qualifications

• Strong secure-by-design architectural skills and ability to translate risk into controls.
• Deep understanding of IT and OT environments and how they interconnect.
• Familiarity with industry standards such as IEC 62443 and related security frameworks.

Responsibilities

• Define the security architecture for OT and IT in coordination with the digital system integrator and sub-system owners.
• Partition the platform into zones and conduits per IEC 62443 and set target security levels.
• Review network architecture and communications security, including remote links and navigation systems.
• Produce the network security architecture in coordination with digital teams.
• Review physical security provisions and develop protection measures in coordination with the arrangement team.
• Define trust boundaries, identity, access management and secure remote access requirements.
• Build the initial asset register for configuration control with criticality and ownership attributes.
• Support threat modelling and security risk assessment from an architecture perspective.
• Define architecture-level security requirements and ensure traceability into overall requirements.

Skills

Security architecture

IT & OT security

IEC 62443 knowledge

Threat modeling

Education

BSc or MSc in Cybersecurity/related

Job description

Expleo is a trusted partner for end-to-end, integrated engineering, quality services, and management consulting for digital transformation. We help businesses harness technological change to successfully deliver innovation, improve resilience and support secure, regulated and operationally critical environments.

As part of the Expleo UK Cybersecurity Practice, you will define and ensure the security architecture for a major UK defence maritime programme, supporting an autonomous surface vessel capability that is being matured towards a whole-ship system design review.

This is a hands‑on architecture role for an engineer who is comfortable designing across operational technology, IT, networks, and physical security, and who can serve as a design lead to naval architects, systems engineers, a digital system integrator, and subsystem owners. Because the platform is designed to operate crewless, the architecture must be fail-safe under compromise and maintain a defined minimum‑risk state upon loss of the remote command-and-control link.

You will own the security architecture and the asset baseline that underpins it, working to the Security Management Plan set by the Secure by Design lead and providing architectural evidence to support formal design review.

Responsibilities

• The role requires strong secure-by-design architectural skills, deep IT and OT understanding, and the ability to translate risk and consequences into segmentation, controls, and defensible design decisions.
• Develop the security architecture for OT and IT in coordination with the digital system integrator and sub-system owners, and produce the preliminary security architecture design.
• Partition the platform into zones and conduits in accordance with IEC 62443, setting target security levels based on safety and mission consequences.
• Review the network architecture and communications security, and provide advice, including on the resilience of remote command-and-control links and of position, navigation, and timing.
• Produce the network security architecture in coordination with the digital teams.
• Review the physical security provision in the design and develop appropriate protection measures, producing the physical security design in coordination with the arrangement team.
• Define trust boundaries, segregation, secure configuration baselines, identity and access management, and secure remote access requirements for shipboard and supporting systems.
• Build and structure the initial asset register for configuration control, capturing criticality, zone, ownership and dependency attributes.
• Support threat modelling and security risk assessment from an architecture perspective, and translate assessed risk into architectural controls.
• Define architecture-level security requirements and maintain their traceability into the wider requirements specification.
• Assure that architectural controls are fail-safe and do not defeat safety functions, working alongside safety and engineering colleagues.
• Provide architectural evidence and materials for internal and external design reviews, including system design reviews, and close out resulting actions.
• Contribute to supplier and interface security requirements where these bear on the architecture, including third-party payload and control-system interfaces.
• Produce clear high- and low-level design material, architecture views, decision records and design rationale suitable for technical scrutiny.

Qualifications

• Relevant education or industry-recognised certifications in security architecture, cybersecurity, secure engineering, operational technology security or a related discipline.
• Suitable qualifications may include BSc, MSc, CISSP, CISM, CRISC, CCP, ISA/IEC 62443 (Fundamentals Specialist, Risk Assessment Specialist, Design Specialist or Expert), SABSA, TOGAF, CCNP, OSCP, ISO 27001 Lead Implementer/Lead Auditor or equivalent professional experience.
• Experience working within UK MOD, defence, maritime, shipbuilding, naval, critical national infrastructure or operationally critical environments would be highly beneficial.