Security Architect

Security Architect

Remote-first (UK): Optional hubs in London, Knutsford

Most security architects spend their time defending designs they inherited, or writing standards that nobody reads.

What if you could set the direction from day one, with the board watching and the budget already committed?

A UK-listed global engineering group is building its security function from the ground up.

Cyber is now a monthly executive committee item, and the CEO wants security to become a commercial differentiator rather than a cost centre.

They need someone to be the security design authority for the whole group. That means one architecture across various corporate functions, spanning cloud, identity, OT boundaries and a growing M&A pipeline.

It's a blank canvas with real complexity and the backing to make it happen.

What You'll Do

• Act as the group's senior security design authority, setting the reference architectures, standards and control patterns every division builds against.
• Shape security across a multi-tenant Microsoft 365 and Azure estate: tenant baselines, Entra, privileged access, separation of duties, and Defender and Sentinel design.
• Define network segmentation, IT/OT boundary principles and endpoint/EDR standards for an environment that runs from offices to ships and offshore energy.
• Embed secure-by-design into a live IT transformation programme, and give architecture assurance on significant change.
• Own the technical assurance programme, including pen testing, vulnerability assessment, control validation and purple/red team activity.
• Act as the technical authority over MDR, managed service and tooling partners.
• Translate architecture risk into business terms for senior leadership and governance forums.

What We're Looking For

• Proven security architecture experience, ideally across a complex, multi-site or multi-divisional organisation.
• Deep identity and access architecture expertise (IAM, PAM, directory and authentication design).
• Strong Microsoft cloud security across Azure, M365, Entra, Defender and Sentinel.
• Network and endpoint security architecture, including segmentation and EDR.
• Experience owning penetration testing and technical assurance, not just consuming the reports.
• A pragmatic, risk-based approach. "Good enough now with a clear target state" beats an ivory-tower design.
• Bonus points for OT/ICS (IEC 62443), defence or MoD supply chain experience, SABSA or TOGAF, CISSP-ISSAP, or Portuguese. None of these are required, and no SC clearance is needed.

You'll be a founding member of a growing function, with leadership and direct reports expected as the team scales through 2027–28. The process is quick, typically two to three stages, and three-month notice periods are fine.

Want to be the person who defines what secure looks like for a global group? Get in touch.

Jono Paisley | Recruitment Consultant @ TRIA

[email protected]