Security Architect

Whitehall Resources are currently looking for a Security Architect based in Cambridge for an initial 6 month contract.

INSIDE IR35

Job Overview

Shape the security foundations of a greenfield on-prem Private Cloud Platform. Embedded full-time within the Engineering IT-led programme, you will be its dedicated Enterprise Security partner. Working alongside architects and engineers, you will translate threats and corporate requirements into secure designs, working controls, automated tests and auditable evidence.

This is a highly technical, hands-on role, requiring deliverables of secure architecture designs, code and configuration reviews, influence engineering decisions, and validation that controls work as designed. Your work will help the organisation enhance services securely in transition to the new platform rather than replicate existing environments through lift-and-shift migration.

Responsibilities

• Own threat modelling across the platform, management plane, infrastructure, workloads, operations and service-onboarding pathways, keeping it current as the architecture evolves.
• Develop realistic threat stories and translate them into engineering requirements, acceptance criteria and delivery priorities, working directly with engineers to design and implement mitigations.
• Maintain traceability of threats and requirements through control implementation, testing and evidence. Own security findings through closure, maintaining the risk and control backlog, assigning actions, tracking remediation and verifying implementation.
• Embed security through infrastructure as code, CI/CD, policy as code, hardened image pipelines and configuration automation.
• Define reusable security standards for identity, privileged access, secrets, PKI, cryptographic keys, secure boot, workload isolation, network segmentation, hardened images, logging, administration and recovery, aligning to existing standards where required.
• Define measurable onboarding requirements and production readiness criteria for services using the platform.
• Translate corporate requirements and frameworks such as NIST and STIGs into pragmatic, testable controls, constructively challenging requirements that do not improve security outcomes.
• Automate security posture and compliance evidence through platform configuration, pipelines, telemetry and tooling wherever possible.
• Establish continuous validation through automated control testing, vulnerability assessment, attack simulation and proportionate penetration testing.
• Act as the conduit between the programme, IT Engineering and Enterprise Security, maintaining shared awareness of requirements, risks and decisions.