Information Security Architect

Purpose of Role  The Information Security Architect is a senior technical role responsible for leading the design and delivery of security solutions across the organisation’s infrastructure and technology programmes. This individual will serve as a subject matter expert on complex security infrastructure projects, providing architecture and design guidance to ensure that all solutions are secure by design and aligned to the organisation’s risk appetite and strategic security vision. The role has two primary pillars of responsibility. First, the Architect will drive solution designs for strategic security infrastructure initiatives, including but not limited to Zero Trust Network Access (ZTNA), Privileged Identity and Access Management (PIM/PAM), Passwordless Authentication, Network Segmentation, Data Loss Prevention (DLP), Cloud Access Security Broker (CASB) technologies and implementing best practices for Vulnerability Management and Threat Detection capabilities. Second, the Architect will act as an Information Security Review (ISR) resource, assisting with IT project reviews and risk assessments to ensure appropriate security controls are embedded throughout the project lifecycle. The successful candidate will bring strong technical depth across security architecture domains, the ability to communicate complex security concepts to both technical and non-technical stakeholders, and a pragmatic approach to balancing security requirements with business objectives. This role sits with the Security Operations function of the Information, Security and Risk department to ensure all controls are operationally effective, integrated into detection tooling, and optimised for real-world threat response.  Key Responsibilities  Security Architecture & Solution Design  Lead the security architecture and solution design for strategic security infrastructure projects, including ZTNA, PIM/PAM, Passwordless Authentication, Network Segmentation, DLP, and CASB implementations, with a SOC-Centric approach at the forefront.  Define, maintain security architecture and governance controls for cloud, data, and AI platforms, including CSPM, DSPM, and AI DSPM capabilities, ensuring the protection of sensitive information and compliance with organisational and regulatory requirements. Ensure logging and telemetry is captured and maintained into SIEM solutions and aligned with SOC requirements.  Architect Microsoft Stack security controls, including Defender XDR ecosystems and Entra ID security architecture are designed and optimised.  Architect security controls and standards on other supported platforms, including AWS and Google Workspace.  Evaluate, recommend, and set security baselines for new and existing security technologies, ensuring alignment with industry best practice and organisational requirements.  Lead the secure adoption and governance of Artificial Intelligence (AI) and Generative AI technologies across the organisation and ensure AI platforms comply with information security, data protection, privacy, intellectual property, and regulatory requirements.  Produce high-quality security architecture documentation including solution designs, architecture decision records (ADRs), and technical standards.  Collaborate with IT, infrastructure, and engineering teams to translate security requirements into practical and deliverable technical solutions.  Provide expert guidance on cloud security architecture (Azure / Microsoft 365 ecosystem) including identity, network, data, and application security controls.  IT Project ISR Review & Risk Assessment  Act as the Information Security Review (ISR) representative for IT projects, assessing proposed solutions, designs, and changes for security risk and compliance.  Conduct structured security risk assessments of IT projects and solution designs, identifying threats, vulnerabilities, and gaps against security standards and policies.  Conduct security and privacy assessments of AI services, including data handling, model usage, third-party risk, and integration controls.  Provide clear and actionable risk-based recommendations to project teams and stakeholders, enabling informed decision-making and risk ownership.  Review and approve IT changes and solution designs, applying security-conscious principles and ensuring residual risks are understood and accepted appropriately.  Maintain an ISR register and track the status of security recommendations, exceptions, and risk acceptances across the project portfolio.  Work collaboratively with the ISR team to ensure consistent application of the security review process across all IT projects.  Governance, Risk & Compliance  Contribute to the development and maintenance of information security policies, standards, and procedures, particularly those relating to architecture, design, and technology controls.  Support the ongoing maintenance of the ISO 27001:2022 ISMS and SOC 2 Type 2, ensuring Architectural controls are documented and evidenced appropriately.  Assist with security risk assessments, gap analyses, and the management of remediation actions arising from audit findings or control deficiencies.  Stakeholder Engagement & Collaboration  Act as a trusted security adviser to IT leadership, project managers, and technical teams, providing pragmatic and commercially aware security guidance.  Represent the Information Security function in architecture review boards, project steering groups, and technical design authorities.  Liaise with third-party vendors and managed service providers to evaluate security capabilities and ensure contractual security obligations are met.  Communicate security architecture decisions and risk positions clearly to both technical and non-technical audiences, including senior stakeholders. Knowledge Requirements    Essential   Demonstrable experience in information security architecture, with a strong track record of delivering complex security infrastructure projects from design through to implementation.   Deep technical expertise across two or more of the following domains: ZTNA, PIM/PAM, Passwordless Authentication, Network Segmentation, DLP, and CASB.  Strong knowledge of Microsoft security technologies, including Microsoft Entra ID (Azure AD), Microsoft Defender suite, Microsoft Purview (DLP/CASB), and Azure networking security controls   Strong understanding of Data Security Posture Management (DSPM), Cloud Security Posture Management (CSPM) and AI Security and Governance   Experience conducting security risk assessments and ISR reviews for IT projects, with the ability to produce clear risk-rated findings and recommendations.   Sound knowledge of identity and access management principles, including privileged access workflows, just-in-time access, and zero trust identity architectures.   Knowledge of network security architecture, including firewall policy design, micro segmentation, east-west traffic controls, and secure remote access patterns.  Familiarity with ISO 27001:2022, SOC 2 Type 2 and other relevant frameworks (e.g. NIST CSF, CIS Controls).   Fluent in English language with excellent written and verbal communication skills, with the ability to produce high-quality architecture documentation and present complex topics clearly to diverse audiences.   5+ years information / cyber security experience, with 2+ years architecture experience  Desirable   Relevant professional certifications such as CISSP, CISM, SABSA, TOGAF, Microsoft Security certifications (e.g. SC-100 Cybersecurity Architect Expert), or equivalent.   Experience working within a global enterprise environment, navigating complex stakeholder landscapes and multi-region security requirements.   Familiarity with cloud security posture management (CSPM) and cloud workload protection platforms (CWPP).   Experience with security automation and infrastructure-as-code approaches to security control deployment.   Knowledge of Microsoft Sentinel and their integration into broader detection and response architectures.   Knowledge of Qualys VMDR and WAS for vulnerability and web application management and detection.   Knowledge of Netskope SASE (Secure Access Service Edge) solution to combine networking and security services into a single architecture, enabling secure access to web, cloud, and private applications.     #LI-NM1#LI-Hybrid