Lead Systems Engineer (Application Security Architect)

Job Description

The successful candidate will be a part of the Information Technology Division.

Key Responsibilities

Application Security Reviews and Threat Modelling

• Lead security architecture reviews and threat modelling for assigned applications, platforms and technology initiatives, translating threats into practical design recommendations.
• Assess authentication and authorization flows, including OAuth 2.0, OpenID Connect and JWT-based implementations.
• Review AI deployment architectures, including retrieval-augmented generation (RAG), Model Context Protocol (MCP) integrations and agent workflows, working with specialists where required.
• Help improve existing AI-enabled threat modelling capabilities and contribute to pilots that support cybersecurity delivery.
• Provide technical guidance and mentoring to security consultants and engineering teams.
• Embed security-by-design practices into development workflows through reusable guidance, design patterns and early engagement with delivery teams.
• Support adoption of security tooling and report meaningful measures of coverage, remediation and developer engagement.
• Help revitalise the Security Champions programme through practical training, knowledge sharing and support.
• Contribute to security architecture standards and decisions across relevant business and technology domains.

Enterprise and Identity Security Architecture

• Design and review identity integration patterns for hybrid and multi-cloud environments, covering human users, workloads and service identities.
• Contribute to identity governance initiatives, including access lifecycle management, least privilege and access reviews.
• Support identity integration for AI systems and automated workflows, including credential handling, delegated access and authorization boundaries.
• Work with platform and DevOps engineering teams to establish secure infrastructure patterns and reusable technology foundations.
• Build trusted relationships with stakeholders, explaining security trade-offs and helping teams implement proportionate controls.

Agentic and Generative AI Security

• Contribute to security blueprints and guardrails for generative AI deployments within the organisation’s AI risk framework.
• Assess risks in AI applications, including prompt injection, sensitive data exposure, excessive permissions and unsafe tool use.
• Help design and implement authentication and authorization controls for AI agents and MCP integrations.
• Partner with AI, engineering and risk teams to implement appropriate monitoring, logging and security controls throughout the AI application lifecycle.

Requirements

• Bachelor’s degree in computer science, engineering or a related field, or equivalent practical experience.
• 5+ years of relevant experience across software engineering, solution architecture or application security.
• Practical experience in application security architecture reviews and threat modelling, with the ability to translate findings into implementable engineering changes.
• Experience delivering security or architecture improvements involving multiple stakeholders.
• Strong understanding of application security principles, including OWASP guidance, secure coding, API security and authentication and authorization.
• Experience integrating or using security tooling within development workflows, including SAST, DAST, software composition analysis, container scanning and secrets management.
• Working knowledge of cloud security and identity patterns in AWS, Azure or comparable environments.
• Practical exposure to securing AI-enabled applications, with familiarity in areas such as LLMs, RAG, MCP or agentic AI. Deep expertise across all these areas is not required.
• Strong communication skills and the ability to explain security risks, discuss trade-offs and work constructively with technical and business stakeholders.
• Experience in the following areas would be beneficial:
  • Experience supporting a Security Champions programme.
  • Experience implementing reusable security patterns, developer guidance or security automation.
  • Exposure to identity governance, workload identity or authorization for AI agents.
  • Relevant certifications, such as GIAC/SANS, AWS or Azure security certifications.