Security Architecture and Controls Lead

Security Architecture and Controls Lead vacancy at the University of Birmingham

Is this your next job Read the full description below to find out, and do not hesitate to make an application.

Up to £87,000 with potential for salary supplement for exceptional candidates

Hays Technology and The University of Birmingham are working in partnership to recruit a Security Architecture and Controls Lead on a permanent basis.

About the role

Reporting to the CISO, the Security Architecture and Controls Lead will act as the University's authority for security architecture and protective controls, providing evidence-based assurance that security controls are operating effectively and identifying where improvements are required.

For the full job description alongside information about cyber and IT services at the university, please visit the dedicated microsite for this role:

• (.)uk/web/university-of-birmingham-it
• What you'll be doing
• Developing and running a continuous security control validation programme across endpoint, identity, email, network, cloud, data and backup environments.
• Using techniques including breach and attack simulation, purple teaming, posture monitoring, attack surface management and detection testing to assess whether controls are deployed, configured correctly and operating effectively.
• Defining security control metrics and risk indicators, using evidence from control validation to identify weaknesses and drive prioritised improvements.
• Owning and maintaining protective security control standards and configuration baselines across endpoint, email, identity, network, cloud and other key security technologies.
• Providing governance over security control configuration, monitoring for control drift and ensuring that weaknesses, exceptions and deviations from agreed standards are appropriately identified, assessed and managed.
• Overseeing the control exceptions process, ensuring exceptions are risk-assessed, documented, subject to appropriate approval and regularly reviewed.
• Working with technology and service teams to drive remediation of control weaknesses and vulnerabilities, monitoring progress against agreed priorities and timescales.
• Maintaining appropriate evidence of control effectiveness to support assurance activity and demonstrate alignment with security standards and frameworks.
• Acting as a security architecture design authority, embedding secure-by-design principles and threat modelling into major technology change. xsabvtc
• Shaping security architecture across AI and agentic technologies, zero trust and identity, Azure, AWS and GCP, Dev Sec Ops and data security.
• Overseeing penetration testing and offensive assurance activity, working with CHECK or CREST-accredited providers and incorporating red and purple team activity into the wider assurance programme....