Security Architect (OT, IT, Network and Physical)

Expleo Group; West of England; Hybrid; GBP 70,000 - 110,000; Full time

Benefits offered by this job

Collaborative environment

ExpleoAcademy programs

Competitive benefits

Hybrid working

Job summary

Expleo Group seeks a seasoned security architect for OT and IT within complex defence-related programmes in the UK. You will define architecture, security zones, and risk-based controls across platforms.

Role requires IEC 62443 expertise, strong collaboration with engineering and safety teams, and experience with shipboard and critical infrastructure environments; SC clearance desirable.

Qualifications

• Education or certifications in security architecture or related discipline.
• Experience in UK defence/maritime or critical national infrastructure environments.
• Proven track record as an OT/IT security architect on complex programmes.

Responsibilities

• Develop security architecture for OT and IT across platforms.
• Define zones, conduits and target security levels per IEC 62443.
• Review network and communications security, resilience of remote links.
• Produce network security architecture with digital teams.
• Define trust boundaries, IAM, secure configurations, remote access.
• Build asset registers for configuration control and risk isolation.
• Support threat modelling and translate risk into controls.
• Ensure architecture is fail-safe with safety in mind.
• Provide design materials for reviews and gate outcomes.
• Engage with suppliers to land architectural requirements.

Skills

IEC 62443

Security architecture

OT/IT security

Risk assessment

Identity & access management

Secure remote access

Communication skills

TEMPEST awareness

Education

BSc/MSc in security/engineering

CISSP/CISM/CRISC or equivalent

TOGAF/ISO 27001 Lead Implementer

Tools

Threat modelling tools

Asset discovery tools

Job description

Expleo is a trusted partner for end-to-end, integrated engineering, quality services, and management consulting for digital transformation. We help businesses harness technological change to successfully deliver innovation, improve resilience and support secure, regulated and operationally critical environments.

Responsibilities

• Develop the security architecture for OT and IT in coordination with the digital system integrator and sub-system owners, and produce the preliminary security architecture design.
• Partition the platform into zones and conduits in accordance with IEC 62443, setting target security levels based on safety and mission consequences.
• Review the network architecture and communications security, and provide advice, including on the resilience of remote command-and-control links and of position, navigation, and timing.
• Produce the network security architecture in coordination with the digital teams.
• Review the physical security provision in the design and develop appropriate protection measures, producing the physical security design in coordination with the arrangement team.
• Define trust boundaries, segregation, secure configuration baselines, identity and access management, and secure remote access requirements for shipboard and supporting systems.
• Build and structure the initial asset register for configuration control, capturing criticality, zone, ownership and dependency attributes.
• Support threat modelling and security risk assessment from an architecture perspective, and translate assessed risk into architectural controls.
• Define architecture-level security requirements and maintain their traceability into the wider requirements specification.
• Assure that architectural controls are fail-safe and do not defeat safety functions, working alongside safety and engineering colleagues.
• Provide architectural evidence and materials for internal and external design reviews, including system design reviews, and close out resulting actions.
• Contribute to supplier and interface security requirements where these bear on the architecture, including third-party payload and control-system interfaces.
• Produce clear high- and low-level design material, architecture views, decision records and design rationale suitable for technical scrutiny.

Qualifications

• Relevant education or industry-recognised certifications in security architecture, cybersecurity, secure engineering, operational technology security or a related discipline.
• Suitable qualifications may include BSc, MSc, CISSP, CISM, CRISC, CCP, ISA/IEC 62443 (Fundamentals Specialist, Risk Assessment Specialist, Design Specialist or Expert), SABSA, TOGAF, CCNP, OSCP, ISO 27001 Lead Implementer/Lead Auditor or equivalent professional experience.
• Experience working within UK MOD, defence, maritime, shipbuilding, naval, critical national infrastructure or operationally critical environments would be highly beneficial.

Essential Skills

• Demonstrable application of IEC 62443, including zones and conduits, target security levels, and 62443-3-2 style risk assessment.
• Strong understanding of secure configuration baselines, hardening, identity and access management and privileged access for OT environments.
• Understanding of secure industrial and platform communications, including relevant protocols, cryptographic protection and public key infrastructure.
• Ability to translate risk and consequence into proportionate architectural controls, and to defend those decisions in technical forums.
• Ability to work across engineering, architecture, platform, IT, OT, assurance and supply chain teams.
• Strong written and verbal communication skills, with the ability to produce precise technical design material.
• TEMPEST awareness, particularly as it relates to defence standards and secure design.

Experience

• Proven experience as a security architect, OT security architect, or secure engineering specialist on complex technical programmes.
• Experience supporting defence, maritime, naval, energy, rail, manufacturing or other critical national infrastructure environments.
• Experience developing enterprise or platform OT security reference architectures.
• Experience of multi-site or multi-system IT and OT segmentation programmes.
• Experience with asset discovery and inventory tooling, and with passive-first approaches in sensitive operational environments.
• Experience supporting factory acceptance testing, site acceptance testing, integration testing or equivalent technical validation from a security perspective.
• Experience working alongside system integrators and sub-system suppliers to land architectural requirements.
• Experience developing security architecture in environments where safety and availability constraints shape the design.
• Experience handling sensitive defence or client information in line with UK MOD, NCSC, client security and data protection requirements.
• Strong experience in a security architecture role covering both operational technology and IT environments.
• Experience designing network segmentation, industrial demilitarised zones, trust boundaries and secure remote access for operational environments.
• Experience securing industrial control systems, embedded or platform control systems, and safety-related control environments.
• Experience producing security architecture documentation, including high- and low-level designs, architecture views and design rationale.
• Experience building or structuring asset inventories and registers to support configuration control and risk assessment.
• Experience contributing security architecture into formal engineering design reviews and assurance gates.
• Experience with shipboard systems, platform systems, mission systems, navigation, propulsion, power management or similar complex operational environments.
• Awareness of maritime cyber engineering benchmarks such as IACS Unified Requirements E26 and E27.
• Experience with autonomous, uncrewed or remotely operated platforms, including command-and-control link protection and position, navigation and timing resilience.
• Experience with data diodes, unidirectional gateways or equivalent high-assurance boundary protection.
• Experience with MOD Secure by Design, NCSC CAF, NIST SP 800-82, ISO 27001 or Def Stan 05-138.
• Experience of physical and electronic security convergence, including protection of equipment spaces and cable routes.

What Do I Need Before I Apply

• Have the right to work in the UK.
• Hold, or be eligible to obtain, UK Security Check (SC) clearance. Clearance is a mandatory requirement for this programme, and applicants must meet the UK residency criteria for security clearance.
• Be willing and able to work in a hybrid model, including client site attendance as required.
• Be comfortable working within secure collaboration environments and handling information marked up to OFFICIAL-SENSITIVE.
• Be able to work under the terms of applicable confidentiality and non-disclosure arrangements.

Benefits

• Collaborative working environment – we stand shoulder to shoulder with our clients and ourpeers through good times and challenges
• We empower all passionate technology loving professionals by allowing them to expand their skills and take part in inspiring projects
• ExpleoAcademy - enables you to acquire and develop the right skills by delivering a suite of accredited training courses
• Competitive company benefits
• Always working as one team, our people are not afraid to think big and challenge the status quo
• As a Disability Confident Committed Employer we have committed to:
  • Ensure our recruitment process is inclusive and accessible
  • Communicating and promoting vacancies
  • Offering an interview to disabled people who meet the minimum criteria for the job
  • Anticipating and providing reasonable adjustments as required
  • Supporting any existing employee who acquires a disability or long term health condition, enabling them to stay in work at least one activity that will make a difference for disabled people

“We are an equal opportunities employer and welcome applications from all suitably qualified persons regardless of their race, sex, disability, religion/belief, sexual orientation or age”. We treat everyone fairly and equitably across the organisation, including providing any additional support and adjustments needed for everyone to thrive