Lead Systems Engineer (Application Security Architect)

Job Description

The successful candidate will be a part of the Information Technology Division.

Key Responsibilities

Application Security Reviews and Threat Modelling

• Lead security architecture reviews and threat modelling for assigned applications, platforms and technology initiatives, translating threats into practical design recommendations.

• Assess authentication and authorization flows, including OAuth 2.0, OpenID Connect and JWT-based implementations.

• Review AI deployment architectures, including retrieval-augmented generation (RAG), Model Context Protocol (MCP) integrations and agent workflows, working with specialists where required.

• Help improve existing AI-enabled threat modelling capabilities and contribute to pilots that support cybersecurity delivery.

• Provide technical guidance and mentoring to security consultants and engineering teams.

• Embed security-by-design practices into development workflows through reusable guidance, design patterns and early engagement with delivery teams.

• Support adoption of security tooling and report meaningful measures of coverage, remediation and developer engagement.

• Help revitalise the Security Champions programme through practical training, knowledge sharing and support.

• Contribute to security architecture standards and decisions across relevant business and technology domains.

Enterprise and Identity Security Architecture

• Design and review identity integration patterns for hybrid and multi-cloud environments, covering human users, workloads and service identities.

• Contribute to identity governance initiatives, including access lifecycle management, least privilege and access reviews.

• Support identity integration for AI systems and automated workflows, including credential handling, delegated access and authorization boundaries.

• Work with platform and DevOps engineering teams to establish secure infrastructure patterns and reusable technology foundations.

• Build trusted relationships with stakeholders, explaining security trade-offs and helping teams implement proportionate controls.

Agentic and Generative AI Security

• Contribute to security blueprints and guardrails for generative AI deployments within the organisation’s AI risk framework.

• Assess risks in AI applications, including prompt injection, sensitive data exposure, excessive permissions and unsafe tool use.

• Help design and implement authentication and authorization controls for AI agents and MCP integrations.

• Partner with AI, engineering and risk teams to implement appropriate monitoring, logging and security controls throughout the AI application lifecycle.

Requirements

• Bachelor’s degree in computer science, engineering or a related field, or equivalent practical experience.

• 5+ years of relevant experience across software engineering, solution architecture or application security.

• Practical experience in application security architecture reviews and threat modelling, with the ability to translate findings into implementable engineering changes.

• Experience delivering security or architecture improvements involving multiple stakeholders.

• Strong understanding of application security principles, including OWASP guidance, secure coding, API security and authentication and authorization.

• Experience integrating or using security tooling within development workflows, including SAST, DAST, software composition analysis, container scanning and secrets management.

• Working knowledge of cloud security and identity patterns in AWS, Azure or comparable environments.

• Practical exposure to securing AI-enabled applications, with familiarity in areas such as LLMs, RAG, MCP or agentic AI. Deep expertise across all these areas is not required.

• Strong communication skills and the ability to explain security risks, discuss trade-offs and work constructively with technical and business stakeholders.

• Experience in the following areas would be beneficial:

• Experience supporting a Security Champions programme.

• Experience implementing reusable security patterns, developer guidance or security automation.

• Exposure to identity governance, workload identity or authorization for AI agents.

• Relevant certifications, such as GIAC/SANS, AWS or Azure security certifications.