Queen Square Recruitment
Senior Enterprise Security Architect
Get notified of more jobs like this · No spam, ever
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Senior Enterprise Security Architect – CIS Controls
Location: London
Contract: 6 months
Rate: Up to £700 per day inside I35
Client: Major UK retail enterprise
The opportunity
We are seeking an experienced Senior Enterprise Security Architect to lead the design and implementation of the Centre for Internet Security (CIS) Critical Security Controls across a large, complex enterprise environment.
This is a hands-on architecture and security transformation role for someone who can translate security frameworks into practical, measurable and automated technical controls. You will establish the architecture, implementation roadmap and governance needed to strengthen security across infrastructure, cloud platforms, endpoints and enterprise operations.
Working closely with infrastructure, cloud, DevOps, network engineering and security operations teams, you will drive the organisation towards a consistent, risk-based security posture aligned with CIS Controls v8 or the latest applicable version.
The role requires a blend of strategic architecture, technical depth, implementation leadership and executive stakeholder engagement.
Key responsibilities
- CIS Controls implementation: Lead the end-to-end assessment, design and implementation roadmap for CIS Critical Security Controls, mapping existing controls, identifying gaps and prioritising remediation against business risk.
- Enterprise security architecture: Define secure architecture patterns and technical standards across on-premises, hybrid and multi-cloud environments.
- Security hardening: Establish and enforce CIS Benchmark-aligned configurations for Windows Server, Linux, cloud services and network infrastructure.
- Security automation: Drive Security as Code through Terraform, Ansible, PowerShell, Python and automated configuration management, reducing reliance on manual intervention.
- Asset management: Improve hardware and software asset discovery, inventory accuracy, configuration visibility and CMDB integration.
- Vulnerability management: Establish risk-based vulnerability assessment, remediation prioritisation and reporting processes using enterprise security tooling.
- Cloud and identity security: Define controls across AWS, Azure and GCP, including cloud governance, IAM, least privilege, Zero Trust and policy enforcement.
- Security operations integration: Align endpoint protection, logging, SIEM/SOAR and monitoring capabilities with enterprise security control requirements.
- Governance and assurance: Develop security policies, standards, architecture decisions, control evidence and measurable KPIs aligned with CIS and relevant frameworks such as NIST CSF and ISO 27001.
- Stakeholder leadership: Present security risks, implementation progress, control effectiveness and remediation priorities to senior leadership, translating technical issues into clear business outcomes.
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
Essential experience
- 10+ years of cybersecurity experience, including at least five years in senior security architecture or security leadership roles.
- Proven, hands-on experience implementing CIS Critical Security Controls across a large enterprise, rather than simply conducting framework assessments or audits.
- Strong knowledge of CIS Implementation Groups (IG1, IG2 and IG3), control prioritisation, maturity assessment and implementation planning.
- Expert knowledge of CIS Benchmarks and secure configuration hardening across Windows and Linux environments.
- Demonstrable experience designing security architecture for cloud, infrastructure and enterprise technology estates.
- Practical experience automating security controls using Terraform, Ansible, PowerShell, Python or equivalent technologies.
- Strong understanding of vulnerability management, asset inventory, endpoint security, identity and access management, logging and security monitoring.
- Experience leading cross-functional security programmes and influencing infrastructure, cloud, DevOps and operations teams.
- Excellent executive communication skills, including security reporting, presentations, risk articulation and stakeholder management.
Get help with your application
Your very own career expert that helps elevate your application to the next level.
Desirable experience
- AWS security governance, including Control Tower and Service Control Policies; Azure Policy and cloud governance; or GCP Organisation Policy Service.
- Enterprise vulnerability tooling such as Tenable, Qualys or Rapid7.
- EDR/XDR and SIEM platforms such as CrowdStrike, SentinelOne, Microsoft Sentinel, Splunk or Google Chronicle.
- Zero Trust architecture, micro-segmentation, encryption standards, key management and enterprise IAM platforms.
- Infrastructure as Code, GitOps, policy as code and automated compliance enforcement.
- CISSP, CISSP-ISSAP, CISM, TOGAF, a recognised cloud security certification or relevant GIAC qualification.
We are particularly interested in candidates who have personally led CIS Controls implementation and can demonstrate how they translated the framework into operational, automated security controls at enterprise scale.
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Location