Security Architecture and Controls Lead

Security Architecture and Controls Lead vacancy at the University of Birmingham
Up to £87,000 with potential for salary supplement for exceptional candidates

Hays Technology and The University of Birmingham are working in partnership to recruit a Security Architecture and Controls Lead on a permanent basis.

About the role

Reporting to the CISO, the Security Architecture and Controls Lead will act as the University's authority for security architecture and protective controls, providing evidence-based assurance that security controls are operating effectively and identifying where improvements are required.

For the full job description alongside information about cyber and IT services at the university, please visit the dedicated microsite for this role:

(.)uk/web/university-of-birmingham-it

What you'll be doing

Developing and running a continuous security control validation programme across endpoint, identity, email, network, cloud, data and backup environments.
Using techniques including breach and attack simulation, purple teaming, posture monitoring, attack surface management and detection testing to assess whether controls are deployed, configured correctly and operating effectively.
Defining security control metrics and risk indicators, using evidence from control validation to identify weaknesses and drive prioritised improvements.
Owning and maintaining protective security control standards and configuration baselines across endpoint, email, identity, network, cloud and other key security technologies.
Providing governance over security control configuration, monitoring for control drift and ensuring that weaknesses, exceptions and deviations from agreed standards are appropriately identified, assessed and managed.
Overseeing the control exceptions process, ensuring exceptions are risk-assessed, documented, subject to appropriate approval and regularly reviewed.
Working with technology and service teams to drive remediation of control weaknesses and vulnerabilities, monitoring progress against agreed priorities and timescales.
Maintaining appropriate evidence of control effectiveness to support assurance activity and demonstrate alignment with security standards and frameworks.
Acting as a security architecture design authority, embedding secure-by-design principles and threat modelling into major technology change.
Shaping security architecture across AI and agentic technologies, zero trust and identity, Azure, AWS and GCP, Dev Sec Ops  and data security.
Overseeing penetration testing and offensive assurance activity, working with CHECK or CREST-accredited providers and incorporating red and purple team activity into the wider assurance programme.
Supporting security assurance against frameworks and standards including the NCSC Cyber Assessment Framework, ISO 27001, NIST CSF 2.0 and Cyber Essentials Plus.
Communicating technical risk and control weaknesses clearly to senior stakeholders, balancing security improvement against cost, resilience and operational requirements.
What we're looking for

Strong experience within security architecture, security assurance or a related technical security discipline.
Experience designing or operating continuous control validation or assurance, such as breach and attack simulation, purple teaming, control monitoring or security posture management.
Strong security architecture knowledge, including practical experience of security design reviews and threat modelling.
Good working knowledge of MITRE ATT&CK, alongside the ability to map security controls against real-world attacker techniques.
Strong experience governing protective security controls, including defining security standards and configuration baselines, monitoring control effectiveness and drift,…