Security Technical Lead/ Application Security Architect

• Act as the senior cybersecurity partner for GFT domains, advising leadership and delivery teams on material cyber risks, control expectations, and risk-based trade-offs.
• Own and drive the domain risk register, ensuring risks are clearly articulated (cause-event-impact) with timebound remediation plans.
• Embed proportionate security-by-design across change delivery, solution designs, and acceptance criteria.
• Strengthen in-service security posture across identity & access risk (including PAM), threat & vulnerability management, logging/monitoring, and configuration weaknesses.
• Oversee supplier and SaaS cyber risk for onboarding and renewals, driving mitigations for access, data protection, and resilience.
• Lead control governance, thematic reviews, and audit readiness, ensuring timely closure of findings.
• Provide cybersecurity leadership support during major incidents, translating technical exposures into executive business impacts (financial reporting, payroll, liquidity).

• Significant cybersecurity and technical risk management experience within a regulated Financial Services or Tier-1 Banking environment.
• Advanced expertise in Cloud Security Architecture (P3 - Advanced) and Application Security Architecture.
• Strong capability in cyber risk articulation (Cause-Event-Impact), issue management, control mapping, and audit engagement.
• Solid technical foundation across IAM/PAM, vulnerability management, SIEM/logging, SaaS/third-party risk, and AI security.
• Fluent English with excellent written and verbal communication skills, confident in chairing governance forums and challenging constructively.
• Must have UK Right to Work and be able to attend the Sheffield office 3 days per week.

Desirable Qualifications:

• Industry certifications such as CISSP, CISM, CRISC, CISA, ISO27001, or CEH.
• Direct experience supporting technology for Finance, Treasury, or Risk domains with sensitivity to financial controls and regulatory reporting.
• Familiarity with operational resilience and technology risk expectations within financial services.