Security Architect

This is a hands-on security architecture role with significant influence across engineering, architecture, cyber security, risk and product teams. You'll own application security architecture across a complex estate that includes new cloud-native services, mobile applications, REST and GraphQL APIs, AI-enabled features and a substantial legacy environment that remains live during transformation.

You'll create the patterns, standards and guardrails that make the secure path the easy one for engineering teams. You'll also lead the design reviews that matter most, guide pragmatic risk decisions, and help ensure our digital services meet the expectations of clients, regulators and the business.

What you'll be doing

Architecture and design

• Own application security architecture across web, mobile, API and cloud-native services, and maintain the reference architectures and patterns engineering teams build against.
• Design the patterns that carry the most weight i.e. authentication and authorisation, token architecture and service-to-service identity, secrets management, cryptography and secure data handling.
• Define API security patterns for both REST and GraphQL, covering authorisation at object and field level, schema exposure, query cost and depth controls, rate limiting and gateway placement, recognising that GraphQL breaks many of the path-based controls that work for REST.
• Set pragmatic security positions for legacy applications, including compensating controls, safe integration with newer services and how security debt is prioritised against the migration roadmap rather than deferred indefinitely.
• Lead security design reviews for significant applications, integrations and client journeys, and take recommendations to the design authority / architecture review board as a technical advisor.

AI security

• Define the security architecture for AI-enabled features built on Amazon Bedrock, covering model access controls, guardrails, prompt and output handling, data residency and cross-region inference, and logging that meets our regulatory retention needs.
• Establish how agentic applications are secured: tool and action permissions, non-human identity and credential scoping, MCP and similar integration layers, human-in-the-loop checkpoints, and containment when an agent behaves unexpectedly.
• Assure third-party and SaaS-embedded AI and set the guardrails for AI-assisted developer tooling used inside our own delivery pipelines.

Threat modelling and risk

• Lead threat modelling for applications, APIs and AI features using STRIDE and OWASP methods, supported by appropriate HL TM tooling, driving the resulting mitigations to closure.
• Assess the security implications of new products, technologies and third-party integrations, and translate emerging attack trends into changes to our patterns and controls.
• Provide technical leadership on security exceptions and risk decisions, including the judgement about when a risk is acceptable.
• Define the security controls and assurance gates in our CI/CD pipelines, covering SAST, DAST, SCA, secrets scanning and container image assurance and how findings reach the teams who fix them.
• Partner with engineering to build secure-by-default capabilities that teams adopt because they are useful, not because they are mandated.
• Strengthen software supply chain controls across dependencies, build provenance and artefact integrity.
• Work alongside SoC, penetration testing and vulnerability management teams so that findings feed back into architecture rather than staying at the individual finding level.

Governance and regulation

• Maintain the application security standards and architectural guardrails and keep them current as the platform changes.
• Ensure designs meet FCA expectations, operational resilience requirements and Consumer Duty considerations for digital client journeys, working with Risk and Compliance where interpretation is needed.

What success looks like

• Engineering teams are building against published patterns for authentication, authorisation, API security and secrets rather than solving those problems individually.
• Threat modelling runs as a routine part of design for significant changes, not as an escalation.
• We have a clear, agreed position on how AI and agentic features are secured and assured, and it is being applied.

About you

• Substantial experience in security architecture with application security as your centre of gravity, at senior level or ready to step up to it.
• You have designed secure architectures for cloud-native applications on AWS, and you understand containers and Kubernetes well enough to reason about the security model rather than only the tooling.
• Real depth in identity and access: OAuth 2.0, OpenID Connect and SAML in practice, authorisation models beyond role checks, and service-to-service authentication. FIDO2 and passwordless experience is a strong plus.
• Practical API security experience across REST and GraphQL, including authorisation design and the failure modes each brings.
• You have worked in a mixed estate and can secure legacy applications proportionately, without either ignoring them or blocking delivery over problems that will disappear at migration.
• You have run complex threat modelling and design reviews as a regular discipline and can point to what changed as a result.
• You have embedded security into Agile and CI/CD delivery in a way that engineers accepted.
• You can influence without authority. Getting a pattern adopted when nobody must adopt it, and saying no in a way that keeps delivery on your side, matters more here than formal sign-off rights.
• You are comfortable in a fast-moving transformation where the target architecture is still being decided.

Experience in financial services or another regulated sector; mobile application security; software supply chain and secure SDLC; hands-on experience with Amazon Bedrock or comparable managed model platforms; familiarity with the OWASP Top 10 for LLM and Agentic Applications; working knowledge of OWASP ASVS, Top 10 and API Security Top 10. Azure exposure is useful, although our estate is AWS-first.

Certifications

CISSP, CCSP or AWS Security Specialty would be valuable, or equivalent demonstrable experience. Other relevant certifications such as CSSLP, SABSA, SANS GCSA or Microsoft Cybersecurity Architect Expert are welcome but not essential.

This will be a 2-stage interview process, consisting of an intro call, competency and behavioural based interview with technical assessment.

Working Schedule

We are based in Bristol, BS1 5HL. This role is permanent, full time, 37.5 hours per week, Monday to Friday. We have returned to the office 2 days a week.

Why us?

Here at HL, we’re the UK’s number 1 investment platform for private investors, based in Bristol. For more than 40 years we’ve helped investors save time, tax and money on their investments.

To achieve our mission, we believe we have a workplace like no other, with constant learning, dynamic teams, and a great ethos. We’re steered by core values that promote service, quality, innovation, and opportunity in everything we do.

What’s on offer?

• Discretionary annual bonus* and annual pay review
• 25 days* holiday plus bank holidays and 1-day additional Christmas closure
• Option to purchase an additional 5 days holiday**
• Flexible working options available, including hybrid working
• Enhanced parental leave
• Pension scheme up to 11% employer contribution
• Income Protection and Life insurance (4 x salary core level of cover)
• Private medical insurance*
• Health care cash plans - including optical, dental, and out patientcare
• Health screening programme
• Help@hand - confidential support including mental health counselling and remote GP
• Wellhub - unlimited access to fitness providers and wellness coach sessions
• Variety of travel to work schemes with bike storage and shower facilities
• Inhouse barista and deli serving subsidised coffee and sandwiches
• Two paid volunteering days per year

** only available to select during our annual benefits window, in November each year

Hargreaves Lansdown is an inclusive employer that values diversity in its workforce. We encourage applications from all individuals without regard to race, religion, gender, sexual orientation, national origin, disability or age.

This role may also be available on a flexible working or part time basis - please ask the Recruitment & Onboarding team for more information.

Please note, we are unable to provide employment sponsorship to candidates.