Information Technology - Lead Systems Engineer (Application Security Architect)

Key Responsibilities Application Security Reviews and Threat Modelling • Lead security architecture reviews and threat modelling for assigned applications, platforms and technology initiatives, translating threats into practical design recommendations. • Assess authentication and authorization flows, including OAuth 2.0, OpenID Connect and JWT-based implementations. • Review AI deployment architectures, including retrieval-augmented generation (RAG), Model Context Protocol (MCP) integrations and agent workflows, working with specialists where required. • Help improve existing AI-enabled threat modelling capabilities and contribute to pilots that support cybersecurity delivery. • Provide technical guidance and mentoring to security consultants and engineering teams. • Embed security-by-design practices into development workflows through reusable guidance, design patterns and early engagement with delivery teams. • Support adoption of security tooling and report meaningful measures of coverage, remediation and developer engagement. • Help revitalise the Security Champions programme through practical training, knowledge sharing and support. • Contribute to security architecture standards and decisions across relevant business and technology domains. Enterprise and Identity Security Architecture • Design and review identity integration patterns for hybrid and multi-cloud environments, covering human users, workloads and service identities. • Contribute to identity governance initiatives, including access lifecycle management, least privilege and access reviews. • Support identity integration for AI systems and automated workflows, including credential handling, delegated access and authorization boundaries. • Work with platform and DevOps engineering teams to establish secure infrastructure patterns and reusable technology foundations. • Build trusted relationships with stakeholders, explaining security trade-offs and helping teams implement proportionate controls. Agentic and Generative AI Security • Contribute to security blueprints and guardrails for generative AI deployments within the organisation’s AI risk framework. • Assess risks in AI applications, including prompt injection, sensitive data exposure, excessive permissions and unsafe tool use. • Help design and implement authentication and authorization controls for AI agents and MCP integrations. • Partner with AI, engineering and risk teams to implement appropriate monitoring, logging and security controls throughout the AI application lifecycle. Requirements • Bachelor’s degree in computer science, engineering or a related field, or equivalent practical experience. • 5+ years of relevant experience across software engineering, solution architecture or application security. • Practical experience in application security architecture reviews and threat modelling, with the ability to translate findings into implementable engineering changes. • Experience delivering security or architecture improvements involving multiple stakeholders. • Strong understanding of application security principles, including OWASP guidance, secure coding, API security and authentication and authorization. • Experience integrating or using security tooling within development workflows, including SAST, DAST, software composition analysis, container scanning and secrets management. • Working knowledge of cloud security and identity patterns in AWS, Azure or comparable environments. • Practical exposure to securing AI-enabled applications, with familiarity in areas such as LLMs, RAG, MCP or agentic AI. Deep expertise across all these areas is not required. • Strong communication skills and the ability to explain security risks, discuss trade-offs and work constructively with technical and business stakeholders. Preferred Experience • Experience supporting a Security Champions programme. • Experience implementing reusable security patterns, developer guidance or security automation. • Exposure to identity governance, workload identity or authorization for AI agents. • Relevant certifications, such as GIAC/SANS, AWS or Azure security certifications.