Security Architect
Role details
Job location
Tech stack
Job description
FDM is a global business and technology consultancy seeking a Security Architect to work for our client within the public sector. This is initially a 6 month contract with very good prospects to extend and will be a remote role with ad hoc travel required to London
The Security Architect plays a key role in ensuring that security is integrated into digital, cloud, and infrastructure initiatives from the earliest design stages. The position provides expert architectural guidance to engineering teams and senior stakeholders, ensuring that solutions are resilient, compliant, and aligned with recognised government policies and industry standards.
With a strong focus on cloud technologies (primarily Microsoft Azure) you will design, review, and assure secure architectures while promoting "Secure by Design" principles. You will work closely with technical and security leadership to deliver robust security outcomes, support assurance activities, and contribute to wider organisational capabilities including resilience, continuity, and service management.
This role has a strategic and hands-on dimension, requiring deep technical expertise, strong stakeholder engagement, and the ability to influence complex delivery environments., Secure Architecture & Threat Analysis
- Design, review, and assure secure architectures across cloud, on-premise, and hybrid environments.
- Conduct threat modelling exercises to identify risks, vulnerabilities, and mitigating controls.
- Ensure architectural decisions align with recognised frameworks and standards including ISO 27001, NCSC guidance, and GDPR.
- Embed secure-by-design principles throughout system life cycles.
Security Policy, Assurance & Compliance
- Develop, maintain, and improve security policies, procedures, and architectural patterns in line with ISO 27001 and BS 10008.
- Support national and departmental assurance processes by coordinating evidence, documentation, and controls.
- Participate in both internal and external IT health checks and continuous assurance activities.
Risk Management & Specialist Advice
- Provide expert guidance on security controls, technology selections, and risk treatment options.
- Support delivery teams with risk assessments and architectural decision-making.
- Integrate security requirements into business continuity planning, service resilience initiatives, service management frameworks, and audit activities.
Stakeholder Engagement & Collaboration
- Communicate security concepts clearly and effectively to both technical and non-technical audiences.
- Influence architectural and delivery decisions across multidisciplinary teams.
- Work collaboratively with internal partners, external suppliers, and assurance bodies to ensure compliance with regulatory and best-practice requirements.
Resilience & Incident Support
- Contribute to incident response planning and recovery strategies.
- Ensure architectural designs support disaster recovery, operational resilience, and continuity objectives.
Requirements
- Security Clearance: Hold, or be eligible to obtain, Security Check (SC) clearance.
- Vetting: Hold, or be eligible for, Non-Police Personnel Vetting Level 3 (NPPV3).
- Secure-by-Design Delivery: Proven experience embedding security-by-design principles within software development, cloud platforms, or system integration projects.
- Technical Breadth: Strong knowledge of secure system architecture, cloud and hybrid environments, threat modelling methodologies, identity and access management, networking, and cryptographic principles.
- Risk, Governance & Compliance: Practical experience applying governance, risk, and compliance frameworks such as ISO 27001, NIST, and NCSC guidance, and translating the CIA triad into effective security controls.
- Leadership & Communication: Ability to explain complex security issues clearly, influence stakeholders, and collaborate effectively across multidisciplinary teams, particularly during assurance and compliance activities., * Professional Certification: Industry-recognised security qualifications such as CISSP, CISM, CISA, or CCSP.
- Policy & Standards Expertise: Demonstrated experience authoring security policies and procedures aligned to ISO 27001 and BS 10008.
- Assurance Frameworks: Familiarity with GovAssure, the NCSC Cyber Assessment Framework, and internal/external audit and IT health-check processes.
- Operational Resilience: Knowledge of business continuity management, service resilience, and service architecture practices
