Principal Security Architect — DevSecOps

UST FinX; United States; On-site; GBP 120,000 - 160,000; Full time

Job summary

UST FinX is seeking a Principal Security Architect — DevSecOps to embed security across the engineering lifecycle. You will design secure patterns, automate controls, and set guardrails across CI/CD, containers, Kubernetes, and SaaS integrations.

Lead threat modeling, reviews, and production readiness with a hands-on engineering approach. You will partner with platform, backend, DevOps, QA, and product teams to ensure security is built in by default and remains observable, compliant, and

Qualifications

• 8+ years in software, security, cloud security, DevSecOps, or platform engineering with production ownership.
• Strong software engineering background with ability to read real code and CI/CD workflows.
• Proven experience securing cloud-native platforms in production.
• Deep secure-SDLC knowledge: threat modeling, automated testing, vulnerability management, and release controls.
• Integrating SAST, DAST, and SCA into CI/CD in a practical, automated way.
• Container security: image scanning, runtime configuration, and deployment hardening.
• Kubernetes security: RBAC, namespaces, network policies, and runtime protection.
• Policy-as-code (OPA, Gatekeeper, Kyverno) and IAM/zero trust models.
• Secrets management: storage, rotation, access control, and governance.
• CI/CD security automation and software supply-chain security.
• Production security: reliability, observability, incident response.
• Strong communication and mentoring to raise engineering standards.
• Comfortable working in a global, distributed organization.

Responsibilities

• Define and evolve the DevSecOps strategy for UST FinX's cloud-native banking platform.
• Embed security across the SDLC — design, coding, build, test, deployment, runtime, monitoring, incident response.
• Implement automated security controls across CI/CD, infrastructure provisioning, and cloud services.
• Integrate and operate SAST, DAST, SCA, container scanning, and policy-as-code.
• Define secure engineering standards and reusable guardrails for fast, safe development.
• Apply cloud-native security patterns: IAM, least privilege, zero trust, runtime security.
• Guide secure architecture for APIs, microservices, and SaaS integrations.
• Partner with platform, backend, DevOps, QA, product, and delivery teams to bake security in.
• Mentor engineers through reviews, threat modeling, and pipeline security.
• Ensure production systems are secure, observable, resilient, compliant.

Skills

Security architecture

DevSecOps

Cloud security

SAST/DAST/SCA

Container security

Kubernetes security

Policy-as-code

Secrets management

CI/CD security

Production security

Mentoring/leadership

Communication

Tools

AWS security

Kubernetes

Terraform

CloudFormation

AWS CDK

GitOps

Job description

Since 1999, UST has worked side by side with the world's best companies to make a powerful impact through transformation.

Headquartered in the United States, UST is powered by technology, driven by AI, inspired by people, and led by our purpose, we partner with our clients from design to operation. Our AI-driven digital solutions, proprietary platforms, engineering, R&D, products, and innovation ecosystem turn core challenges into impactful, disruptive business outcomes.

With deep industry knowledge and a future-ready mindset, we infuse expertise, innovation, and agility into our clients' organizations—delivering measurable value and positive lasting change for them, their customers, and communities around the world. Together, with 30,000+ employees in 30+ countries, we build for boundless impact—touching billions of lives in the process.

Visit us at www.ust.com.

UST FinX was born from a shared passion and unwavering commitment to solve one of the most pressing challenges facing the banking industry today: the technology imprisonment of banks by legacy platforms that stifle innovation, constrain growth, and diminish competitive viability. We are a team of dedicated professionals who came together with a singular vision - to liberate banks from the technological constraints that prevent them from serving their customers and communities to their full potential.

We are looking for a Principal Security Architect — DevSecOps to embed security into every stage of our engineering lifecycle. This is a senior, hands-on technical leadership role — not policy-only, audit-only, or advisory.

Your influence comes from designing secure engineering patterns, automating controls, building guardrails, reviewing real systems, and writing production-grade code and configuration so teams build secure platforms by default. You will define and evolve security architecture across our cloud-native platform, CI/CD pipelines, software supply chain, Kubernetes, container workloads, SaaS integrations, APIs, secrets management, IAM, and runtime controls — working directly with engineering teams to make security part of daily delivery rather than a late-stage approval.

You bring a strong software engineering background, have secured production cloud-native platforms, and know how to balance security, delivery speed, developer experience, and operational resilience.

You translate security principles into reusable patterns, automated checks, policy-as-code, secure defaults, and developer-friendly guardrails, and you stay close to implementation.

In an increasingly AI-assisted environment, you apply engineering judgment to validate, refine, or reject generated outputs, ensuring controls are automated, observable, repeatable, and embedded rather than theoretical or manual.

We value a 360-degree, merit-based culture where senior architects constructively challenge designs and help teams converge on secure, scalable patterns.

What You Will Do

• Define and evolve the DevSecOps strategy for UST FinX's cloud-native banking transformation platform.
• Embed security across the SDLC — design, coding, build, test, deployment, runtime, monitoring, and incident response.
• Design and implement automated security controls across CI/CD pipelines, infrastructure provisioning, application delivery, container images, Kubernetes, and cloud services.
• Integrate and operationalize SAST, DAST, SCA, container scanning, secrets scanning, and policy-as-code.
• Define secure engineering standards and reusable guardrails that let teams move quickly within approved boundaries.
• Apply cloud-native security patterns: IAM, network segmentation, workload identity, secrets management, least privilege, zero trust, runtime security, and auditability.
• Guide secure architecture for APIs, microservices, event-driven systems, SaaS integrations, and developer tooling.
• Partner with platform, backend, DevOps, QA, product, and delivery teams so security is built in, not bolted on.
• Mentor engineers through design reviews, threat modeling, code and pipeline reviews, and pairing.
• Ensure production systems are secure, observable, resilient, compliant, and ready for regulated banking.

This role reports directly to the CTO of UST FinX. You will operate as one of the CTO's senior technical lieutenants — creating engineering leverage across the organization while remaining deeply hands-on. You will influence multiple pods, establish reusable standards, mentor technical leaders, challenge weak designs, and turn technical direction into production-quality execution.

This is neither a passive advisory role nor a traditional people-management role; your authority comes from technical credibility, judgment, and execution.

Working closely with the CTO, you will define standards, identify engineering gaps, raise delivery quality, and ensure architecture is reflected in real code, platforms, and operational behaviour — a force multiplier who executes, coaches others, and resets the technical bar across UST FinX.

Skills and Experience

• 8+ years in software, security, cloud security, DevSecOps, or platform engineering (10–15 ideal), with production platform ownership.
• Strong software engineering background — able to read real application code, system design, CI/CD workflows, infrastructure automation, and runtime behaviour.
• Proven experience securing cloud-native platforms in production.
• Deep secure-SDLC knowledge: secure design and coding, threat modeling, automated testing, vulnerability and dependency management, release controls, and production readiness.
• Integrating SAST, DAST, and SCA into CI/CD in a practical, automated, developer-usable way.
• Container security: image scanning, base-image strategy, registry controls, remediation, runtime configuration, and secure workload deployment.
• Kubernetes security: cluster hardening, namespace isolation, RBAC, admission control, network policies, workload identity, pod security, secrets, ingress, and runtime protection.
• Policy-as-code (OPA, Gatekeeper, Kyverno, or equivalent). IAM, least privilege, zero trust, workload identity, service-to-service authentication, and identity-driven security models.
• Secrets management: secure storage, rotation, access control, pipeline integration, runtime injection, and governance. Securing SaaS integrations and platform architectures: identity, access, data protection, tenant boundaries, and auditability.
• CI/CD security automation: pipeline hardening, artifact integrity, dependency controls, environment promotion, deployment approvals, rollback safety, and supply-chain security.
• Production security: reliability, auditability, scalability, incident response, monitoring, ing, and remediation.
• Strong communication — explaining architecture, risks, and trade-offs to globally distributed teams.
• Mentoring and technical leadership that raises the standard of surrounding engineers without formal authority.
• Comfortable in a global, distributed organization with multiple pods, stakeholders, and time zones.

Preferred Qualifications

• AWS security: IAM, Organizations, networking, KMS, CloudTrail, GuardDuty, Security Hub, workload identity, private connectivity, and multi-account patterns.
• Amazon EKS or equivalent Kubernetes in production.
• IaC security: AWS CDK, Terraform, CloudFormation, static analysis, policy enforcement, and secure module design.
• GitOps security: repository controls, signed artifacts, environment promotion, drift detection, and deployment guardrails.
• Software supply-chain security: SBOMs, artifact signing, provenance, dependency controls, and build integrity.
• Observability and security monitoring: Prometheus, Grafana, CloudWatch, OpenTelemetry, SIEM, tracing, logging, and event correlation.
• API security: OAuth2/OIDC, mTLS, service mesh, gateway security, rate limiting, token validation, and service-to-service authorization.
• Financial services, banking, or regulated environments where auditability and operational control are critical.
• Building reusable security platforms, guardrails, templates, policy libraries, and paved-road patterns consumed by multiple teams.
• Living with the long-term consequences of architecture decisions — supporting, patching, auditing, scaling, migrating, and evolving secure platforms after adoption.

What we believe:

We’re proud to embrace the same values that have shaped UST since the beginning. Since day one, we’ve been building enduring relationships and a culture of integrity. And today, it's those same values that are inspiring us to encourage innovation from everyone, to champion diversity and inclusion, and to place people at the centre of everything we do.

Humility:

We will listen, learn, be empathetic and help selflessly in our interactions with everyone.

Humanity:

Through business, we will better the lives of those less fortunate than ourselves.

Integrity:

We honor our commitments and act with responsibility in all our relationships.

Equal Employment Opportunity Statement

UST is an Equal Opportunity Employer.

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran.

UST reserves the right to periodically redefine your roles and responsibilities based on the requirements of the organization and/or your performance.