Security Architecture & Controls Lead in London

Security Architecture and Controls Lead vacancy at the University of Birmingham Permanent Role Hybrid - Birmingham Up to £87,000 per annum plus benefits with potential for salary supplement for exceptional candidates Hays Technology and The University of Birmingham are working in partnership to recruit a Security Architecture and Controls Lead on a permanent basis. About the role Reporting to the CISO, the Security Architecture and Controls Lead will act as the University's authority for security architecture and protective controls, providing evidence-based assurance that security controls are operating effectively and identifying where improvements are required. For the full job description alongside information about cyber and IT services at the university, please visit the dedicated microsite for this role: webmicrosites.hays.co(.)uk/web/university-of-birmingham-it What you'll be doing Developing and running a continuous security control validation programme across endpoint, identity, email, network, cloud, data and backup environments. Using techniques including breach and attack simulation, purple teaming, posture monitoring, attack surface management and detection testing to assess whether controls are deployed, configured correctly and operating effectively. Defining security control metrics and risk indicators, using evidence from control validation to identify weaknesses and drive prioritised improvements. Owning and maintaining protective security control standards and configuration baselines across endpoint, email, identity, network, cloud and other key security technologies. Providing governance over security control configuration, monitoring for control drift and ensuring that weaknesses, exceptions and deviations from agreed standards are appropriately identified, assessed and managed. Overseeing the control exceptions process, ensuring exceptions are risk-assessed, documented, subject to appropriate approval and regularly reviewed. Working with technology and service teams to drive remediation of control weaknesses and vulnerabilities, monitoring progress against agreed priorities and timescales. Maintaining appropriate evidence of control effectiveness to support assurance activity and demonstrate alignment with security standards and frameworks. Acting as a security architecture design authority, embedding secure-by-design principles and threat modelling into major technology change. Shaping security architecture across AI and agentic technologies, zero trust and identity, Azure, AWS and GCP, DevSecOps and data security. Overseeing penetration testing and offensive assurance activity, working with CHECK or CREST-accredited providers and incorporating red and purple team activity into the wider assurance programme. Supporting security assurance against frameworks and standards including the NCSC Cyber Assessment Framework, ISO 27001, NIST CSF 2.0 and Cyber Essentials Plus. Communicating technical risk and control weaknesses clearly to senior stakeholders, balancing security improvement against cost, resilience and operational requirements. What we're looking for Strong experience within security architecture, security assurance or a related technical security discipline. Experience designing or operating continuous control validation or assurance, such as breach and attack simulation, purple teaming, control monitoring or security posture management. Strong security architecture knowledge, including practical experience of security design reviews and threat modelling. Good working knowledge of MITRE ATT&CK, alongside the ability to map security controls against real-world attacker techniques. Strong experience governing protective security controls, including defining security standards and configuration baselines, monitoring control effectiveness and drift, managing exceptions and driving remediation of identified weaknesses. Knowledge of the NCSC CAF and at least one of ISO 27001 or NIST CSF 2.0. Experience of zero trust and identity architecture, including conditional access and adaptive authentication. Experience scoping, commissioning or managing penetration testing. The ability to translate complex technical security issues and trade-offs for both technical and senior non-technical audiences. A relevant security qualification such as CISSP, SABSA, CCSP or TOGAF with a security specialism, or demonstrable equivalent experience. Experience within higher education, research-intensive or similarly complex environments would be advantageous. Exposure to AI security, multi-cloud security, DevSecOps, data protection engineering or Microsoft security technologies including Defender XDR, Sentinel, Intune, Entra ID and Purview would also be beneficial. What you'll get in return A salary of up to £87,000 per annum Salary supplement for exceptional candidates - enquire for details A hybrid arrangement of 3 days in office and 2 days per week from home Universities Superannuation Scheme (USS) pension of 22% (9% personal, 13% UofB contribution) 25 days annual leave, 7 University Closure Days, 8