{"id":1398100,"url":"https://alion.io/job/allwyn-security-architect","title":"Security Architect","company":{"id":5850,"name":"Allwyn","domain":"allwyn.co.uk","url":"https://alion.io/company/allwyn","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workable","truth_index":{"grade":"A","score":89,"open_postings":9,"ghost_share":0,"stale_share":0.444,"repost_share":0,"time_to_fill_p50_days":34,"computed_at":"2026-09-28T05:45:00Z"}},"role":"Security","role_family":"Security","seniority":"staff","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Warrington, United Kingdom"],"countries":["GB"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":85000,"max_usd":200000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":415},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agile","optional":false},{"name":"Burp Suite","optional":false},{"name":"CI/CD","optional":false},{"name":"GraphQL","optional":false},{"name":"ISO 27001","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP ASVS","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"OWASP ZAP","optional":false},{"name":"PCI DSS","optional":false},{"name":"Rest API","optional":false},{"name":"Snyk","optional":false},{"name":"SonarQube","optional":false},{"name":"STRIDE","optional":false},{"name":"Kubernetes","optional":true}],"status":"live","first_seen_at":"2026-09-28T14:15:21Z","employer_posted_date":"2026-09-28","last_verified_at":"2026-09-28T21:58:57Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"At the heart of everything we do is our vision to change lives every day, and our mission to grow The National Lottery responsibly and champion its impact.\nWe are Allwyn UK, part of the Allwyn Entertainment Group - a multi-national lottery operator with a market-leading presence across the USA (Michigan and Illinois) and Europe, including Czech Republic, Austria, Greece, Cyprus and Italy.\nWhile the main contribution of The National Lottery to society is through the funds to good causes, at Allwyn we put our purpose and values at the heart of everything we do. Join us as we embark on a once-in-a-lifetime, largescale transformation journey by creating a National Lottery that delivers more money to good causes.\nWe’ll talk a bit more about us further down the page, but for now - let’s talk about the role and who we’re looking for…\nAbout the role\nWorking within the Enterprise Security team, you will provide specialist security architecture for customer-facing and enterprise applications across web, mobile, API and supporting cloud services. You will shape secure designs from discovery through delivery, translate risk into proportionate security requirements, and help engineering teams embed security throughout the software development lifecycle.\nThis is an architecture-led role with practical application security depth. You will not simply identify vulnerabilities: you will influence application and platform design, define reusable patterns, guide security testing, support remediation decisions and provide clear risk advice to technical and business stakeholders.\nWhat you’ll be doing\nProvide security architecture support to mobile and web application initiatives from discovery and design through build, testing, release and operation. \nPartner with solution architects, software engineers, product teams, delivery leads and third parties to ensure security is designed in early without losing sight of pace, cost, usability and quality. \nProduce and maintain high-level and detailed security designs, security requirements, architecture decisions, patterns and supporting assurance evidence. \nLead application threat modelling using structured techniques such as STRIDE, documenting threats, attack paths, trust boundaries, mitigations and residual risks. \nAssess web applications, native and cross-platform mobile applications, APIs, microservices, identity flows, cloud services and third-party integrations. \nDefine security requirements for authentication, authorisation, session management, secrets, cryptography, data protection, API security, logging, monitoring, resilience and secure configuration. \nApply recognised application security guidance, including OWASP Top 10, OWASP ASVS, OWASP MASVS and relevant secure-by-design principles. \nGuide teams on secure mobile design, including secure storage, platform permissions, transport security, certificate handling, local data protection, application integrity and mobile backend/API controls. \nGuide teams on secure web design, including browser security controls, input and output handling, access control, session security, dependency risk and protection against common web attack classes. \nAdvise on application security testing strategy, including SAST, DAST, SCA, secrets scanning, API testing, mobile application testing, IAST and penetration testing. \nSupport the integration of proportionate security controls and automated testing into CI/CD pipelines, including the definition of quality gates and exception routes. \nReview security findings, challenge false positives where appropriate, prioritise remediation based on risk and support teams in agreeing pragmatic corrective actions. \nProduce penetration test scopes and security test plans, coordinate internal and external testing, and assess whether findings have been adequately remediated. \nIdentify and communicate security risks, control gaps and non-compliance clearly, supporting accountable owners to reach an informed risk position. \nContribute to reusable security patterns, standards, guardrails and reference architectures for mobile, web and API delivery. \nCoach engineering and architecture communities on secure design, threat modelling and secure development practices. \nWhat experience we’re looking for\nMust Have:\nSignificant experience in application security architecture, product security or security engineering within an enterprise environment. \nSecurity design experience across modern web applications, mobile applications and APIs. \nStrong knowledge of common web, mobile and API threats and appropriate security controls. \nPractical experience of threat modelling and translating findings into clear, traceable security requirements. \nGood understanding of secure SDLC, DevSecOps, Agile delivery and CI/CD security. \nExperience defining and interpreting application security testing, including SAST, DAST, SCA, API, mobile and penetration testing. \nKnowledge of application identity and access management, including authentication, authorisation, federation, tokens and session security. \nUnderstanding of cloud-native architecture, including containers, serverless services and microservices. \nExperience assessing data flows and defining controls for sensitive data. \nStrong written and verbal communication skills, with the ability to provide clear, pragmatic and risk-based advice \nTechnical knowledge\nWeb and API security, including HTTP/S, browser controls, CORS, CSP, REST and GraphQL. \niOS and Android security, including secure storage, permissions, deep links, transport security and application integrity. \nApplication security tools such as Burp Suite, OWASP ZAP, Snyk, SonarQube or equivalent. \nWorking knowledge of a mainstream programming or scripting language. \nSecurity logging, monitoring and incident response for customer-facing applications. \nRelevant frameworks and standards, including OWASP, NIST, ISO 27001, CIS and PCI DSS. \nNice to Have:\nExperience securing high-volume digital services in a regulated environment. \nKnowledge of app-store releases, mobile attestation, application shielding or runtime protection. \nFamiliarity with container security, Kubernetes, infrastructure as code or policy as code. \nExperience developing application security patterns, standards or developer enablement programmes. \nA relevant security certification such as CISSP, CSSLP, SABSA, CREST or OSWE. \nExperience in lottery, gaming, payments, retail, finance or another regulated sector.\nAbout us\nAt Allwyn, we are dedicated to changing lives and growing the National Lottery responsibly, championing its positive impact on people, places, and the planet.\nInnovation - We pride ourselves on it! We’re constantly looking for new ways to excite our customers, bringing new products to market to enjoy which is all supported by our responsible play values and making them accessible to all. \nGiving back - Did you know that playing the lottery generates around £30m a week for charities and good causes in the UK? Our aim is to have doubled this number by the end of the first 10-year license. \nSustainability - Our aim is to become a net zero national lottery. We have 2030 targets to decarbonise our operations and energy. We’ve already transitioned to renewable energy providers, made our London and Watford offices zero gas, and ensured our fleet consists of low-emission vehicles. In addition, we’re working with our value chain partners to develop a net zero target date. \nEmpowering every voice - We believe in creating a culture where everyone feels they belong, can be themselves, has access to opportunities and can thrive for the benefit of good causes. Our diverse teams are working hard to make all parts of The National Lottery inclusive - whether people play a game in a store or online, because when everyone can play, everyone wins.. \nAn inclusive reward offering with wellbeing at the centre\nAt Allwyn, inclusion is built into how we care for our people. Our benefits and policies support colleagues and their families at every stage of life and career. By prioritising wellbeing and belonging, we create a workplace where everyone feels valued, rewarded, and empowered to succeed. Our people are more than colleagues - they’re winners, driving positive change and making a real difference in communities.\nBenefits\nCompany Bonus Scheme \nMatched pension contributions up to 8.5% \n26 days annual leave + 2 Life Days (and bank holidays) \nSingle Private Health Cover \nComplimentary Private Medical \nIncome Protection \nFlexible Benefits - EV Scheme, Money Coach, Will Writing, Mortgage Advice, Dental and Eye Care Schemes. \nEnhanced Family Leave (Maternity, Paternity, Adoption) \nWellness Allowance £500 \nEmployee Assistance Programme \nDiscounted Health Assessments \nVolunteering Days \nMatched Funding \nWe are a Disability Confident Leader which means we’ve taken proactive steps to ensure our workplace is accessible and inclusive for disabled and neurodivergent colleagues and candidates. As part of this we offer an interview to disabled applicants who meet the essential requirements of the job.\nIf you need any assistance or adjustments to this job description or in the application process, please contact a member of the talent team at  and we’ll be happy to help.","description_format":"text","description_chars":9286,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Annual leave","Parental leave"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["iGaming & Gambling"],"lifecycle":[{"event":"open","at":"2026-09-28T14:15:21Z"}],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":34,"reasons":["conf:1","win:early"],"computed_at":"2026-09-28T23:17:01Z"},"pay":null,"html_url":"https://alion.io/job/allwyn-security-architect","json_url":"https://alion.io/job/allwyn-security-architect.json","meta":{"generated_at":"2026-09-28T23:17:01Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","usage":{"tier":"crawler","counted_by":"address","units_charged":1,"used_today":848,"day_limit":5000,"remaining_today":4152,"minute_limit":60,"resets_at":"2026-09-29T00:00:00Z"}}}