Data Security Architect

Data Security ArchitectRole OverviewWe are seeking a Senior Data Security Architect to provide architecture leadership and delivery across data security, cryptography, and AI security. The role will focus on modernising cryptographic and PKI capabilities, strengthening enterprise data security posture, establishing AI security control planes, and delivering foundational security visibility and endpoint capabilities.Working closely with domain owners and architecture teams, the Data Security Architect will translate security strategy into practical architecture, patterns, roadmaps and implementation outcomes within a large-scale, regulated environment.Key ResponsibilitiesLead architecture assessments and migration strategies for replacing legacy username/password authentication with certificate-based authentication, ensuring alignment with cryptographic and IAM standards.Define architecture for Certificate Lifecycle Management (CLM) uplift, including automation gateways, API-driven certificate requests and application migration.Deliver architecture for HSM modernisation, including Payshield and Entrust remote management and monitoring, Keysafe 5 and associated operational-model changes.Develop the architecture for SSH Zero Trust, including PrivX migration, SSH key reduction and automated key management, while supporting the Cryptographic Bill of Materials (CBOM) framework.Provide architecture leadership for Data Security Posture Management (DSPM) across cloud and on-premises environments, covering data discovery, visibility, control, misconfiguration detection and policy enforcement.Support the Securing AI workstream, including AI security product implementation, AI-SPM and enterprise AI security control-plane architecture.Provide architecture support for foundational security visibility and endpoint capabilities, including:Microsoft Defender for Endpoint (MDE) deployment across Linux estatesIllumio macro- and micro-segmentationAlgoSec firewall policy orchestrationIsland Browser and Akamai Kona/AAP adoptionBluecoat decommissioningMaintain architecture governance artefacts, including control-to-capability traceability, architecture decision records, reference patterns, risk/exception documentation and handover packs.Work collaboratively with domain architects, engineering teams, security specialists and relevant product owners to ensure architecture decisions translate into implementable solutions.Required Experience & SkillsProven experience as a Senior Enterprise Security Architect or Solution Security Architect, ideally within a large, complex and highly regulated environment; financial services experience strongly preferred.Strong practical expertise in data security and AI security, with additional depth in cryptography, PKI or platform security.Hands-on experience with one or more of:PKI and certificate lifecycle managementHSM platforms and key managementSSH security and key-management modernisationStrong understanding of DSPM, data discovery, classification, labelling and cloud data protection controls.Applied knowledge of AI security and governance, including AI gateways, AI-SPM, model governance, AI-BOM, agentic identity and RAG/LLM security controls.Experience developing security architecture patterns, reference architectures, target-state designs and implementation roadmaps.Comfortable operating within formal architecture governance, including Design Authority, architecture review boards, decision records, risk acceptance and exception processes.Strong ability to create clear, structured architecture documentation and maintain traceability from security controls and requirements through to capabilities and implementation.Excellent stakeholder management and communication skills, with the ability to work effectively across security, technology, engineering and business teams.Comfortable operating in a delivery-focused environment, balancing strategic architecture with hands-on support for active technology programmes.