Senior Information Security Architect

ZipRecruiter; Cardiff; On-site; GBP 75,000 - 85,000; Full time

Job summary

A leading broadcasting company in the UK is seeking a Security Engineer to join their Information Security team. This role involves performing security risk assessments, providing guidance on security enhancements, and collaborating with various BBC product teams. An ideal candidate has familiarity with programming languages and a strong understanding of security principles. The position offers a competitive salary and encourages flexible working arrangements.

Qualifications

• Experience designing and implementing digital software projects.
• Ability to break complex problems into manageable parts.

Responsibilities

• Perform security risk assessments on BBC Digital Product environments.
• Develop and maintain relationships with key stakeholders.

Skills

Familiarity with programming language (e.g., Python, JavaScript)

Ability to convey complex technical knowledge

Self-direction in required learning

Experience deploying systems to cloud environments (e.g. AWS)

Technical security knowledge

Job description

Job Description

Overview

This job is with BBC, an inclusive employer and a member of myGwork – the largest global platform for the + business community. Please do not contact the recruiter directly.

Details

JOB BAND: D
CONTRACT TYPE: Permanent
DEPARTMENT: BBC Information Security
LOCATION: All UK

PROPOSED SALARY RANGE: £75,000 - £85,000 depending on relevant skills, knowledge and experience. The expected salary range for this role reflects internal benchmarking and external market insights.

We\'re happy to discuss flexible working. If you\'d like to, please indicate your preference in the application - though there\'s no obligation to do so now. Flexible working will be part of the discussion at offer stage.

Purpose of the role

The BBC Information Security Team works with BBC teams around the world to provide expert advice, review systems, and deal with threats. We ensure risks are identified, managed and mitigated. We are a multi-disciplinary team who work together and with the rest of the business to ensure the BBC stays secure and our audience trust is protected.

You\'ll be joining the Security Engineering & Architecture team in Information Security. The team\'s focus is to ensure the BBC\'s digital products and platforms are secure by leveraging our collective development and security experience. To ensure security requirements are considered and implemented, we work with product teams during the early stages of the SDLC and provide our expert technical advice to allow them to progress effectively. The team also designs, develops and deploys systems and processes to help teams understand the risks in their own systems.

Another key part of the team\'s function is to foster relationships across the business and ensure that security issues are discussed and actioned rather than ignored. The team runs a large network of Security Champions across the BBC which focuses on awareness and education of technical security topics which helps amplify Information Security\'s effectiveness. The team also provides technical expertise to other areas of the wider Information Security Team and BBC.

Why join the team

The BBC reaches over half a billion people online every week. By joining this team you will help keep these systems secure. You\'ll regularly collaborate with critical BBC product teams such as iPlayer, Sounds and News. You\'ll also get continual exposure to the latest security vulnerabilities, the new technologies teams are leveraging and the security considerations around these technologies. You\'ll also become a key part in helping to evolve our digital security strategy and drive transformation within the BBC.

Your responsibilities and impact

• Architecture of Systems
  • Perform security risk assessments on BBC Digital Product environments at various stages of the Software Development Life Cycle (SDLC) and recommend security enhancements, remediation and mitigation strategies.
• Digital Policy & Guidance
  • Research and understand new security technologies, trends and threats related to BBC Digital Products and environments and use this research to provide technical and non-technical guidance to both internal stakeholders and 3rd-parties.
  • Assist in running the BBC Security Champions network including facilitating sessions, engaging with champions, providing guidance around security queries and continuing to evolve the network.
  • Support tactical initiatives to secure Digital Product environments for the BBC including contributing to Information Security policies, procedures and standards.
  • Develop and maintain relationships with Digital Product key suppliers, Digital Product staff, Security Champions and other stakeholders.
• Development
  • Peer with the rest of the InfoSec team to design, develop and deploy code for systems that assist the BBC InfoSec function and assist BBC teams to understand their current risk posture.
• Vulnerability Management
  • Support the processes around security issues identified in BBC Digital Product environments, including assisting with investigation, validation and revalidation.

Your skills and experience

• Familiarity with at least one programming language (e.g., Python, JavaScript) with demonstrable experience designing and implementing digital software projects using these languages.
• Ability to convey complex technical knowledge and guidance, in written form and verbally, to multiple audiences including internal stakeholders and third parties.
• Demonstrable ability to break complex problems into tangible parts, self-direct required learning and operate in a semi-autonomous manner.
• Experience deploying systems and applications from code to a cloud environment (e.g. AWS).
• Demonstrable experience of a wide range of technical security knowledge and applying this to identify and remediate security issues in digital software products.

Desirable but not required

• Experience of being involved in a community and taking an active lead in organising and facilitating.
• Experience with STRIDE Threat Modelling and mitigating issues from application security tooling would be ideal.

If you can bring some of these skills and experience, along with transferable strengths, we\'d love to hear from you and encourage you to apply.

#LI-DNI