> Markdown version of [/jobs/ext/2795751-information-security-architecture-engineering-lead-uk-based](https://www.wearedevelopers.com/jobs/ext/2795751-information-security-architecture-engineering-lead-uk-based). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Information Security Architecture & Engineering Lead (UK-based) - **Company:** PCI Pal - **Location:** Greater London, UK - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Kubernetes Security, .NET Framework, Microsoft Windows, Application Programming Interfaces (APIs), Artificial Intelligence, Amazon Web Services, Microsoft Azure, Bash Shell, C Sharp (Programming Language), Cloud Computing Security, Cloud Engineering, Code Review, Cyber Security, Continuous Integration, Identity and Access Management, Python (Programming Language), Network Segmentation, Open Web Application Security, PCI Data Security Standards, Windows PowerShell, Systems Development Life Cycle, Software Tools, Cloud Services, Zero Trust Network Access, Secure Coding, Software Engineering, Data Streaming, EndPointSecurity, Policy as Code, Scripting, Large Language Models, Software Security, Microsoft InTune, Production Code, Restful APIs, Software Version Control, Devsecops, Api Management, Security Orchestration, Automation & Response, Static Application Security Testing - **Published:** September 8, 2026 - **Apply:** https://www.collegerecruiter.com/job/2820327628-information-security-architecture--engineering-lead-uk-based ## About the Role * Demonstrable and considerable experience in cloud security architecture (AWS essential and Azure), including IAM design, network segmentation, and secrets/KMS management. * Hands-on DevSecOps experience: CI/CD pipeline security, Infrastructure-as-Code scanning, and policy-as-code. * Strong hands-on software development and scripting capability, including Python and C#/.NET, with the ability to read, review and write secure production-quality code; familiarity with PowerShell, Bash, REST APIs and common software development tooling. * Experience building security automation, API integrations, test harnesses or internal engineering tools, using source control, peer review, testing and secure coding practices. * Experience threat-modelling applications and cloud workloads at the design stage, not just reviewing them after deployment. * Working knowledge of PCI DSS v4.0.1. ISO/IEC 27001:2022; familiarity with ISO/IEC 42001:2023 is an advantage. * Experience triaging and remediating findings from a CNAPP or cloud security posture tool. * Experience providing technical oversight to an offshore or distributed engineering team, including runbook design and quality assurance. * Strong stakeholder communication skills, able to advise Engineering, Product and Pre-Sales credibly. * Extremely strong documentation skills. * Experience with AI/LLM security testing (OWASP LLM Top 10, prompt injection, model/vendor risk assessment). * Familiarity with the Microsoft 365 E5 security stack (Entra ID, Defender for Endpoint, Intune), given PCI Pal's existing Zero-Trust investment. * Container/Kubernetes security experience. * Relevant certification: CISSP, CCSP, AWS Certified Security Specialty, or equivalent. * Experience operating within a PCI DSS Level 1 service provider or merchant environment. * Prior experience transitioning a function from reactive/operational delivery to an architecture- and engineering-led model. * Own architecture review and sign-off for all new AWS production changes, including network segmentation, IAM design, and KMS/secrets management etc. * Threat-model new cloud services and workloads before go-live, rather than reviewing them after deployment. * Own remediation design, not just triage, for CNAPP and associated cloud security service findings, including closing current findings based upon risk classification and associated requirements. * Set forward-looking security architecture patterns and guardrails ahead of Engineering's roadmap, not behind it. ## Description The Information Security Architecture & Engineering Lead forms the technical heart of PCI Pal's Information Security function. The role owns cloud architecture review, DevSecOps and secure SDLC practice, security automation and tooling, and security architecture strategy for the organisation, replacing reactive, post-deployment triage with design-stage security input across Engineering, Product and Pre-Sales., * Develop and maintain security automation, integration and validation tooling using Python and C#/.NET, with appropriate use of PowerShell, Bash and relevant APIs/SDKs. * Review security-relevant application code and engineering patterns, and produce proof-of-concept code, test harnesses and remediation examples where required. * Provide secure SDLC guidance to the Engineering function through the central advisory model, design reviews, sign-off gates, and scheduled sessions. * Extend coverage into container and API security as the function's remit grows (Phase 3 of the deployment plan). AI & Emerging Risk * Provide technical engineering support to the AI Security & Governance function for LLM/model security testing (OWASP LLM Top 10 etc.), including scripted test harnesses and repeatable validation tooling, where execution capacity is needed. * Support technical validation of AI/cloud vendor control claims (e.g. redaction testing, data flow verification) where risk warrants it, alongside AI Security & Governance. Central Advisory to Engineering, Product & Pre-Sales * Provide the technical security voice in customer-facing pre-Sales conversations and Product design discussions, on a scheduled and on-request basis. * Maintain the design review calendar and RACI agreed with Engineering, Product and Pre-Sales, explicitly a central advisory relationship, not a placement or embedded model. * Lead joint threat-modelling cycles for major product changes. Governance & Reporting * Provide technical risk input into Information Security GRC's risk register and Statement of Applicability, rather than GRC compiling technical risk independently. * Report progress against the Target Operating Model roadmap to the Information Security Project Manager & CISO. ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [DevSecOps: Injecting Security into Mobile CI/CD Pipelines](https://www.wearedevelopers.com/videos/273-devsecops-injecting-security-into-mobile-ci-cd-pipelines) - [JavaScript? No. Java Scripts! - Scripting with Java](https://www.wearedevelopers.com/videos/2094-javascript-no-java-scripts-scripting-with-java) - [Old tools, new tricks](https://www.wearedevelopers.com/videos/1916-old-tools-new-tricks) - [DevSecOps culture](https://www.wearedevelopers.com/videos/783-devsecops-culture) - [DevSecOps: Security in DevOps](https://www.wearedevelopers.com/videos/36-devsecops-security-in-devops) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers) - [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this) - [Dev Digest 121 - AI goes offline](https://www.wearedevelopers.com/magazine/456-dev-digest-121-ai-goes-offline)