> Markdown version of [/jobs/ext/3903934-security-architect](https://www.wearedevelopers.com/jobs/ext/3903934-security-architect). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Security Architect

- **Company:** Biller Genie
- **Location:** Belfast, UK
- **Experience:** Experienced
- **Salary:** £66,936.0
- **Contract:** Permanent contract
- **Skills:** Microsoft Windows, Artificial Intelligence, Software System Penetration Testing, Microsoft Azure, Software as a Service, Cloud Computing Security, Cyber Security, Identity and Access Management, Intrusion Detection and Prevention, PCI Data Security Standards, Anti-Phishing, Secure Coding, Security Information and Event Management, Software Engineering, Systems Integration, Software Vulnerability Management, Data Logging, Data Classification, Large Language Models, Software Security, National Institute of Standards and Technology Cybersecurity Framework, Patch Management, CIS Benchmarks, Static Application Security Testing, Vulnerability Analysis, Dynamic Application Security Testing
- **Published:** October 24, 2026
- **Apply:** https://www.adzuna.co.uk/jobs/details/5939661183

## About the Role

* 7+ years in information security, including 3+ years in a security architecture or security leadership role.
 * Proven experience building a security program or governance framework from an early-maturity starting point.
 * Strong working knowledge of security frameworks such as NIST CSF, ISO 27001, CIS Controls, and SOC 2.
 * Hands-on experience securing Microsoft Azure and Microsoft 365 environments.
 * Experience with endpoint detection and response (Microsoft Defender preferred), SIEM, and identity platforms (e.g. JumpCloud, Entra ID).
 * Experience writing and running incident response, BC/DR, and tabletop exercise programs.
 * Familiarity with secure SDLC practices and application security tooling.
 * Excellent written and verbal communication, with the ability to explain risk clearly to executives and engineers alike

Desirable Criteria:

 * Experience in fintech, payments, or SaaS organizations handling financial data.
 * Working knowledge of PCI DSS 4.0 and experience supporting audits or a SOC 2 Type 2 program.
 * Experience with cloud security posture management and software supply-chain security.
 * Relevant certifications such as CISSP, CISM, CCSP, or Azure Security Engineer (AZ-500).
 * Experience securing AI/LLM tooling and integrations.

## Description

Position Overview: We are looking for our first dedicated Security Architect to own Information Security across Biller Genie. Today, security responsibilities are spread across IT and Engineering and handled largely as needed. You will bring that work together under a single, accountable function: setting the strategy, building the governance framework, and partnering with IT and Engineering to raise our security maturity across our production platform, corporate environment, endpoints, and product development lifecycle.
This is a hands-on leadership role. You will write policy and present to the executive team, but you will also design controls, tune detection tooling, and sit with engineers to review architecture., * Establish and own the Information Security governance framework, including policies, standards, and procedures, and secure executive approval for them.

 * Develop and maintain a leadership-approved Information Security risk management strategy and risk register.
 * Implement security incident management procedures covering reporting, classification, response, record-keeping, and post-incident review.
 * Deliver regular reporting to senior leadership on security posture, incidents, risks, and program progress.
 * Implement third-party and vendor risk management procedures, including security assessment, approval, and ongoing assurance.
 * Own Business Continuity and Disaster Recovery planning and run regular exercises to validate them.
 * Maintain a threat intelligence process that tracks advisories from government and industry bodies and turns them into action.
 * Define regulatory, contractual, and breach-notification obligations, and keep security controls aligned with compliance frameworks (e.g. PCI DSS, SOC 2) and cyber insurance requirements.
 * Own the Information Security budget and make resourcing and tooling recommendations.

Production Environment Security

 * Define and maintain security architecture standards for our cloud production environments, in partnership with Engineering.
 * Implement Cloud Security Posture Management practices and policy.
 * Establish vulnerability and patch management procedures, including software supply-chain and dependency management, with defined remediation SLAs.
 * Design production monitoring, logging, and threat detection capabilities.
Develop production incident response, compromise recovery, and ransomware response plans, and run regular tabletop exercises against them.

 * Define production backup, recovery, and resilience standards, including recovery time and recovery point objectives.
 * Oversee the security testing program, including vulnerability scanning, penetration testing, and its evolution against emerging threats.
 * Govern production identity, access, and secrets management standards.

Corporate Environment Security

 * Define and implement identity and access management standards, including privileged access governance and periodic access reviews.
 * Establish credential and secrets governance procedures, including the full joiner-mover-leaver lifecycle.
 * Implement data classification, handling, retention, and destruction policies across the organization.
 * Define corporate backup, recovery, and compromise response procedures.
 * Establish centralized security logging, monitoring, and alerting (SIEM) capabilities, with clear ownership.
 * Implement corporate vulnerability management and security testing practices.
 * Govern the secure use of AI tools and AI-integrated systems across the business.

Device & Endpoint Security

 * Own the endpoint security strategy and the configuration, tuning, and effectiveness review of endpoint protection tooling.
 * Define and implement device security policies, including Bring Your Own Device (BYOD) and mobile device management.
 * Strengthen device authentication and hardening standards.
 * Establish lost and stolen device procedures, and regularly validate remote response capabilities.

Secure Product Development

 * Establish a Secure Software Development Lifecycle (SSDLC) with Engineering, including written secure coding standards and how they are enforced.
 * Embed threat modelling and security-by-design reviews into product planning and architecture.
 * Implement automated security testing (SAST, DAST, dependency and secrets scanning) within CI/CD pipelines.
 * Define data protection standards for the product, including PII identification and mapping, encryption, and multi-tenant isolation.
 * Establish vulnerability disclosure procedures and assess the case for a bug bounty program.
 * Define source code integrity, repository access, and tamper-recovery standards.

Security Training & Awareness

 * Design and run an ongoing security awareness program aligned to compliance requirements, covering phishing, social engineering, AI and deepfake threats, and related risks such as financial fraud.
 * Implement role-based security training for Engineering and privileged users.
 * Establish training completion tracking and reporting, with a recurring (at least annual) refresh.
 * Keep training content up to date as new threats emerge