Enterprise Security Architect - Financial Services - £120k-£140k

As a critical member of the Enterprise Architecture Center of Excellence (EA CoE), the Enterprise Security Architect (ESA) plays an integral role in ensuring that their Security Strategy and security Architecture are integrated effectively into the wider Enterprise Architecture domains, with strong focus on end-to-end secure application development lifecycle, and DevSecOps practice. 

Primary Responsibilities

• Develop strong partnership with CISO and security organization, as trusted strategic advisor, assist in development, documentation and maintenance key strategic security artifacts, including:
  • Security architecture at enterprise level (current and future state), based on EA principles, integrated with other technical domains, and aligned with business and threat drivers.
  • Security strategy plans and roadmaps based on sound enterprise architecture practices, capability model
  • Practices for secure applications/services architecture, data encryption and tokenization in the organization, based on the organization's data classification criteria
• Mature practices in application management,  cloud management policies  and standards security domains
• Develop secure coding/software development standards, patterns and “shift left” best practice, enable DevSecOps practice, and serve as technical security advisor to value stream teams to ensure secure coding practice and security related non-functional requirement are met.
• Take a multi layered approach to security architecture (on-premises & cloud-native), “connect the dots” in developments and changes in the digitized and threat environments to ensure that they're adequately addressed in security strategy plans and architecture artifacts
• Provide consulting for IT security, application,  infrastructure and other reference architectures, to ensure security best practices, enhance security controls and reduce risks, where applicable.
• Facilitate threat modelling of services and applications that tie to the risk and data associated with the service or application
• As part of architectural governance process, review security technologies, tools and services, and makes recommendations to the broader security team for their use, based on security, financial and operational metrics
• Stay abreast of emerging technology and security trends, and drive forward thinking in modernization of security architecture and technology stack.

Experience

• Bachelor's degree in computer science, Computer Science, Information Technology or related field, or equivalent experience
• Experience in using architecture methodologies such as SABSA, TOGAF, etc.
• Knowledge of security infrastructure capabilities, e.g., firewalls, intrusion prevention systems (IPSs), web application firewalls (WAFs), endpoint protection, SIEM and log management technology.
• Experience securing CI/CD pipelines.
• Experience designing the deployment of applications and infrastructure into public cloud services.
• Direct experience designing IAM, API security and data access technologies for multi-tier application and distributed services, based on SAML, OAuth, OIDC
• Service management and service delivery experience with global companies