Head of Security Architecture and Engineering - CISO function - BPL in London

Purpose of the role: To develop, implement and manage the bank’s cloud and security infrastructure, including the development and implementation of effective security administration processes for all platforms.

Accountabilities:

• Execution of assessments and analysis on new security technologies in the bank, including cloud access security brokers (CASBs), cloud data loss prevention (DLP) solutions, and cloud encryption solutions, to secure the bank’s cloud environments through seamless integration.
• Development and implementation of effective security administrative processes for all platforms, including cloud security architecture, aligned to the organisation’s security and regulatory requirements.
• Implementation of cloud security monitoring solutions to detect and alert on potential security threats and anomalies.
• Execution of incident investigations related to cloud security to identify the root causes and implement corrective measures promptly to minimise damage and return to normal operations.
• Identification, analysis and implementation of emerging cloud security technologies and solutions to prevent threats and enhance the bank’s cloud security posture.
• Development and maintenance of comprehensive documents and reports for senior stakeholders on cloud security architecture, policies, procedures and incidents.
• Collaboration with cloud operation team to manage the bank’s cloud security infrastructure, including identity and access management (IAM), network security, and data security controls, to protect cloud resources from unauthorized access and data breaches.

Director Expectations:

• To manage a business function, providing significant input to function wide strategic initiatives; contribute to and influence policy and procedures for the function and plan, manage and consult on multiple complex and critical strategic projects, which may be business wide.
• Manage the direction of a large team or sub‑function, leading other people managers and embedding a performance culture aligned to the values of the business.
• Train, guide and coach less experienced specialists and provide information affecting long‑term profits, organisational risks and strategic decisions.
• Manage, coordinate and enable resourcing, budgeting and policy creation for a significant sub‑function.
• Foster and guide compliance, ensure regulations are observed with relevant processes in place to facilitate adherence.
• Demonstrate extensive knowledge of how the function integrates with the business division / Group to achieve the overall business objectives.
• Use interpretative thinking and advanced analytical skills to solve problems and design solutions in often complex / sensitive situations.
• Negotiate with and influence stakeholders at a senior level both internally and externally.

All Senior Leaders are expected to demonstrate a clear set of leadership behaviours to create an environment for colleagues to thrive and deliver to a consistently excellent standard. The four LEAD behaviours are: L – Listen and be authentic, E – Energise and inspire, A – Align across the enterprise, D – Develop others. All colleagues will be expected to demonstrate the Barclays Values of Respect, Integrity, Service, Excellence and Stewardship – our moral compass, helping us do what we believe is right. They will also be expected to demonstrate the Barclays Mindset – to Empower, Challenge and Drive – the operating manual for how we behave.

Key Responsibilities:

• Define and own the security reference architecture for the cloud‑native platform, including network security patterns, identity and authentication, encryption, logging, and inter‑service communication security.
• Own the cloud security posture management (CSPM) strategy, ensuring continuous monitoring and automated enforcement of security policies across the entire cloud estate.
• Set and maintain security technical standards, including approved technologies, cryptographic algorithms, authentication protocols, and secure design patterns for microservices.
• Lead the identity and access management strategy, including privileged access management (PAM), service identity (workload identity, service accounts), RBAC models, and zero‑trust architecture principles.
• Own the data security strategy, including cardholder data tokenisation, encryption key management (HSM/KMS), data classification, and data loss prevention implementation.
• Chair the Security Architecture Board, reviewing architecture proposals, approving non‑standard patterns, updating standards, and maintaining a decision log.
• Ensure security guardrails are implemented as automated policies that scale with the platform and enforce security without manual intervention.
• Publish self‑service security capabilities for engineering teams: secure base images, IaC security modules, encryption libraries, IAM templates, and approved architecture blueprints.
• Collaborate closely with Platform Engineering to embed security into the platform layer, ensuring security is a property of the infrastructure, not an afterthought applied on top.
• Advise the CISO on technical security strategy, emerging technology risks, and the security implications of architectural decisions.
• Support PCI DSS compliance from an architectural perspective, ensuring the platform design supports scope minimisation, network segmentation, and the technical requirements of PCI DSS 4.0.
• Manage and develop the Security Architecture and Engineering team of five, building deep technical capability across cloud security, identity, cryptography, and architecture.

Key Deliverables:

• Security reference architecture document, covering cloud, network, identity, data, and application layers — reviewed and updated bi‑annually.
• Cloud security policy‑as‑code library integrated into deployment pipelines.
• IAM strategy and RBAC model documentation, including privileged access management implementation and zero‑trust roadmap.
• Data security and encryption standards document, including approved algorithms, key management procedures, and tokenisation architecture.
• Technology security standards catalogue (approved languages, frameworks, libraries, protocols, and configurations).
• Secure design pattern library for common scenarios.
• Security Architecture Board minutes and decision log.
• CSPM compliance dashboard and drift reporting.
• Secure base image catalogue for containers and VMs, published and maintained.

Required Skills and Experience:

• AWS Security Specialty, GCP Professional Cloud Security Engineer, or equivalent cloud security certification.
• Significant experience within FinTech or PayTech/Payments Acquiring.
• CISSP‑ISSAP (Architecture concentration), SABSA, or TOGAF certification.
• Experience with payment processing architectures.
• Kubernetes security certifications.
• Experience with zero‑trust architecture implementation.
• Experience with service mesh security and mTLS implementation at scale.
• Published security architecture patterns, conference presentations, or thought leadership.
• Several years of progressive experience in security engineering or security architecture, with a few years in a leadership role managing a security engineering team.
• Deep hands‑on experience with at least one major cloud provider at an architectural level.
• Strong understanding of cloud‑native architectures and their security implications.
• Experience designing and implementing security guardrails as code.
• Understanding of cryptographic principles and their practical application in payment systems.
• Experience leading technical teams, mentoring engineers, and building team capability in a growing organisation.
• Ability to communicate architectural decisions and trade‑offs to both deeply technical engineers and non‑technical executives.
• Understanding of PCI DSS from an architectural perspective.
• Experience with identity architecture.
• Strong understanding of infrastructure‑as‑code practices and CI/CD pipeline architecture.