Security Architect, Hargreaves Lansdown

• We know that sometimes people can be put off applying for a job if they don't tick every box. If you're excited about working for us and have most of the skills or experience we're looking for, please go ahead and apply. We’d love to hear from you!
• Substantial experience in security architecture with application security as your centre of gravity, at senior level or ready to step up to it
• You have designed secure architectures for cloud-native applications on AWS, and you understand containers and Kubernetes well enough to reason about the security model rather than only the tooling
• Real depth in identity and access: OAuth 2.0, OpenID Connect and SAML in practice, authorisation models beyond role checks, and service-to-service authentication. FIDO2 and passwordless experience is a strong plus
• Practical API security experience across REST and GraphQL, including authorisation design and the failure modes each brings
• You have worked in a mixed estate and can secure legacy applications proportionately, without either ignoring them or blocking delivery over problems that will disappear at migration
• You have run complex threat modelling and design reviews as a regular discipline and can point to what changed as a result
• You have embedded security into Agile and CI/CD delivery in a way that engineers accepted
• You can influence without authority. Getting a pattern adopted when nobody must adopt it, and saying no in a way that keeps delivery on your side, matters more here than formal sign-off rights
• You are comfortable in a fast-moving transformation where the target architecture is still being decided

Desirable

• This is a hands-on security architecture role with significant influence across engineering, architecture, cyber security, risk and product teams
• You’ll own application security architecture across a complex estate that includes new cloud-native services, mobile applications, REST and GraphQL APIs, AI-enabled features and a substantial legacy environment that remains live during transformation
• You’ll create the patterns, standards and guardrails that make the secure path the easy one for engineering teams
• You’ll also lead the design reviews that matter most, guide pragmatic risk decisions, and help ensure our digital services meet the expectations of clients, regulators and the business
• Own application security architecture across web, mobile, API and cloud-native services, and maintain the reference architectures and patterns engineering teams build against
• Design the patterns that carry the most weight i.e. authentication and authorisation, token architecture and service-to-service identity, secrets management, cryptography and secure data handling
• Define API security patterns for both REST and GraphQL, covering authorisation at object and field level, schema exposure, query cost and depth controls, rate limiting and gateway placement, recognising that GraphQL breaks many of the path-based controls that work for REST
• Set pragmatic security positions for legacy applications, including compensating controls, safe integration with newer services and how security debt is prioritised against the migration roadmap rather than deferred indefinitely
• Lead security design reviews for significant applications, integrations and client journeys, and take recommendations to the design authority / architecture review board as a technical advisor
• Define the security architecture for AI-enabled features built on Amazon Bedrock, covering model access controls, guardrails, prompt and output handling, data residency and cross-region inference, and logging that meets our regulatory retention needs
• Establish how agentic applications are secured: tool and action permissions, non-human identity and credential scoping, MCP and similar integration layers, human-in-the-loop checkpoints, and containment when an agent behaves unexpectedly
• Assure third-party and SaaS-embedded AI and set the guardrails for AI-assisted developer tooling used inside our own delivery pipelines
• Lead threat modelling for applications, APIs and AI features using STRIDE and OWASP methods, supported by appropriate HL TM tooling, driving the resulting mitigations to closure
• Assess the security implications of new products, technologies and third-party integrations, and translate emerging attack trends into changes to our patterns and controls
• Provide technical leadership on security exceptions and risk decisions, including the judgement about when a risk is acceptable
• Define the security controls and assurance gates in our CI/CD pipelines, covering SAST, DAST, SCA, secrets scanning and container image assurance and how findings reach the teams who fix them
• Partner with engineering to build secure-by-default capabilities that teams adopt because they are useful, not because they are mandated
• Strengthen software supply chain controls across dependencies, build provenance and artefact integrity
• Work alongside SoC, penetration testing and vulnerability management teams so that findings feed back into architecture rather than staying at the individual finding level
• Maintain the application security standards and architectural guardrails and keep them current as the platform changes
• Ensure designs meet FCA expectations, operational resilience requirements and Consumer Duty considerations for digital client journeys, working with Risk and Compliance where interpretation is needed
• Engineering teams are building against published patterns for authentication, authorisation, API security and secrets rather than solving those problems individually
• Threat modelling runs as a routine part of design for significant changes, not as an escalation
• We have a clear, agreed position on how AI and agentic features are secured and assured, and it is being applied

• End Date: August 23, 2026
• This will be a 2-stage interview process, consisting of an intro call, competency and behavioural based interview with technical assessment