Software Security Architect

We are seeking a Software Security Architect to own the delivery and continuous improvement of software security across our product line.

You will provide the technical leadership that turns security objectives into practical architecture, engineering standards and secure products.
Working throughout the product lifecycle, you will collaborate with engineering teams to ensure security is considered from initial concept and design through development, verification, release and ongoing maintenance.
If you have a strong background in secure device architecture and enjoy combining strategic ownership with hands-on technical influence, this is an opportunity to make a significant impact within an innovative technology company based in Waterbeach, Cambridge.

Due to the nature of our UK customer base, the successful candidate may be expected to complete UK Security Clearance (SC) vetting.

Take ownership for the definition, delivery and continuous improvement of software security across the full product line.
The Security Architect turns security objectives into practical architecture, engineering controls and evidence, ensuring that product teams build, verify, release and maintain secure software throughout the product lifecycle.

• Create and maintain the software security strategy, target state and prioritized roadmap for the product line.
• Be accountable for security architecture decisions and for the consistent application of security requirements across products, platforms and shared components.
• Maintain a product-line view of software security risk, technical debt, dependencies and remediation commitments, escalating material gaps with clear options and recommendations.
• Define what good looks like through measurable controls, assurance evidence and acceptance criteria.
• Integrate security requirements and threat modelling into product planning, architecture, design and backlog refinement.
• Establish proportionate security gates across implementation, code review, build, test, release and maintenance activities.
• Partner with engineering teams to ensure vulnerabilities are triaged, owned and resolved according to risk, with exceptions explicitly documented and approved.
• Ensure security is planned and delivered as part of normal product development rather than treated as a separate compliance activity.

• Integrate security requirements and threat modelling into product planning, architecture, design and backlog refinement.
• Establish proportionate security gates across implementation, code review, build, test, release and maintenance activities.
• Partner with engineering teams to ensure vulnerabilities are triaged, owned and resolved according to risk, with exceptions explicitly documented and approved.
• Ensure security is planned and delivered as part of normal product development rather than treated as a separate compliance activity.

• Provide authoritative guidance on secure design, trust boundaries, identity, authentication, authorization, cryptography, data protection, secure communications and platform hardening.
• Define reusable patterns, reference architectures, coding standards and engineering guardrails that enable teams to deliver securely and efficiently.
• Review significant designs and changes, challenging assumptions and driving decisions to resolution.
• Guide the selection and effective use of security tooling within development and CI/CD workflows.

• Define the security evidence required to support release decisions and product assurance.
• Coordinate security testing, vulnerability assessment and remediation across products and releases.
• Ensure software security considerations are addressed through deployment, update, support, incident response and end-of-life activities.
• Provide a clear security position for major releases, including residual risks, approved exceptions and recommended actions.
• Ensure product security architecture, engineering controls and lifecycle processes support compliance with the EU Cyber Resilience Act (CRA).

• Act as the software security authority for product and engineering stakeholders, translating risk into clear delivery decisions.
• Build security capability across engineering through coaching, design reviews, practical guidance and communities of practice.
• Work with product, systems, quality, compliance and operational…