Lead Security Architect National: 71,835-81,090; London: 75,585-84,840 p.a. + benefits

We are currently looking for a Lead Security Architect to join our Strategy & Architecture Function within the Digital & Technology group.

This is a full-time opportunity, on a permanent basis. The role will be based in 7/8 Wellington Place, Leeds, LS1 4AP.

Government departments and agencies are working towards implementing a minimum 60% attendance in office sites.

We are currently implementing a flexible, hybrid way of working, with a minimum of 8 days per month working on site to enable the collaboration and contact with partners and stakeholders needed to deliver MHRA business. Attendance on site is driven by business needs so depending on the nature of the role, this can flex up to 12 days a month, with the remainder of time worked either remotely or in the office. Some roles will need to be on site more regularly. Please discuss this with the recruiting manager before accepting an appointment.

In recognition of the need to attract and retain employees with specialist skills this role attracts a Market Pay Supplement of up to 22,802 per annum. This non-contractual supplement is reviewed at the end of the probation period and thereafter annually and is non-pensionable.

Who are we?

The Medicines and Healthcare products Regulatory Agency enhance and improve the health of millions of people every day through the effective regulation of medicines and medical devices, underpinned by science and research.

The Digital and Technology Group (DTG) lies at the heart of the Agency and is responsible for delivering an optimised IT infrastructure and maximising the secure use of data to enable our scientists, inspectors, and the rest of the organisation to deliver world class services which can improve outcomes for patients and the general public. The Group was essential in the race to approve COVID-19 vaccines in 2020 and in supporting the UK to set up its own medicines and devices approvals systems following our exit from the EU. The work we do matters! 

Its centre of excellence is also responsible for delivering a broad portfolio of change initiatives, both to transform the Agencys legacy technologies and to deliver innovative new solutions, designed around our customers needs. DTG works in a holistic way to combine digital and technology change, data and information management, project delivery, business process, product management and cultural change to maximise out impact and ensure sustainability. 

We plan to be at the heart of one of the most digitally advanced medical regulators in the world and we need people who can help us deliver that ambition. DTG is a great place to build your career, and we are committed to enabling our people to do the best work of their lives. 

Whats the role?

As an IT Security Architect, you will play a critical role in safeguarding the departments IT infrastructure and sensitive data, responsible for designing, building, and maintaining robust security architectures that protect the department's systems from threats and vulnerabilities.

Your primary goal is to ensure that all IT services and solutions are secure by design and compliant with government security policies and standards.

This role requires a strategic thinker with deep technical expertise knowledge, an understanding of emerging threats, and the ability to work collaboratively with various stakeholders to embed security principles throughout the IT landscape. You will work closely with various stakeholders, including business leaders, IT teams, and external partners, to develop and implement security strategies that align with the department's objectives and regulatory requirements.

Key responsibilities:

• Security Architecture Design
• Security Policy Development and Compliance
• Security Awareness and Training
• Stakeholder Engagement and Collaboration
• Innovation and Continuous Improvement

Who are we looking for?

Our successful candidate will:

• Develop and maintain a comprehensive Security Architecture framework that aligns with the IT strategy, government policies, and best practices.
• Develop, implement, and maintain security policies, standards, and procedures in line with government regulations, industry standards, and departmental needs, ensuring that all IT systems and solutions comply with relevant legal, regulatory, and governmental standards, such as GDPR, Cyber Essentials, Secure By Design.
• Collaborate with cross-functional teams to ensure security is integrated into all aspects of the Agencys digital transformation initiatives.
• Stay abreast of industry trends, emerging technologies, and best practices in Technical Architecture, bringing forward recommendations for improvement.

Method of assessment: A=Application, T=Test, I=Interview, P=Presentation

Behaviour Criteria:

• Leadership (I)
• Making Effective Decisions (I)
• Working Together (I)
• Communicating and Influencing (P)

Experience Criteria:

• Extensive experience designing, implementing, and managing the security architecture for large, complex organisations, with deep expertise in security architecture principles including defence in depth, zero trust, least privilege, and secure by design approaches (A, I, P)
• Strong risk and assurance capability, including conducting risk assessments and threat modelling, developing risk management strategies, and leading internal and external security audits, assessments, and penetration testing aligned to frameworks such as CAF and NIST (A, I)
• Proven track record in security governance and continuous improvement, including developing and maintaining security policies, standards, and procedures in line with industry best practice, and applying up to date knowledge of emerging threats, vulnerabilities, and trends to strengthen organisational security posture (A)

Technical Criteria:

• Experience in designing and implementing secure network architectures, including knowledge of network protocols, segmentation, firewalls, VPNs, and intrusion detection/prevention systems (IDS/IPS) in on-premise and cloud environments (A, P)
• Demonstrable experience with a range of security technologies and tools, including but not limited to: (A)
  • Identity and Access Management (IAM), SIEM tools, endpoint protection, and cryptography and encryption solutions, Data Protection and Privacy Controls, Vulnerability Management, Security Orchestration, Automation, and Response (SOAR) Tools, Secure Mobile and Endpoint Computing and securing web applications, APIs, and microservices
• Degree level or significant professional experience (A)
• Desirable: Familiarity with UK public sector regulations, standards, and frameworks, such as the Government Digital Service (GDS), Secure by Design, Cyber Essentials, NCSC guidelines, GDPR, and ISO/IEC 27001 (A)
• Desirable: Security qualification e.g. CISSP, SABSA (A)

If you would like to find out more about this fantastic opportunity, please read our Job Description and Person Specification!

Please note: The job description may not open in some internet browsers. Please use Chrome or Microsoft Edge. If you have any issue viewing the job description, please contact [email protected]