Principal Security Architect

Successful candidates may be based in any of our office locations – Cardiff, London or Glasgow.

We especially welcome applicants from Cardiff and Glasgow.

Across government, secure architecture has become a critical discipline in ensuring that digital services are resilient, trustworthy and designed to withstand an evolving and increasingly sophisticated threat landscape. As organisations adopt cloud-first strategies, modern development practices and complex supply chains, the need for strong security leadership at the design stage has never been greater. Embedding security from the outset—rather than retrofitting controls—enables organisations to deliver services safely, efficiently and at scale, while maintaining public trust and meeting regulatory obligations.

At Ofgem, secure system design is fundamental to delivering our mission to protect energy consumers and support the transition to a secure, affordable and sustainable energy system. As we continue to expand our digital, data and technology capabilities, it is essential that security is built into every layer of our services and platforms. Within the Digital, Data and Security Services (DDSS) directorate, we are strengthening our security architecture capability to ensure consistent, high-quality, “secure by design” approaches across the organisation.

As a Principal Security Architect, you will provide strategic leadership and deep technical expertise to ensure that Ofgem’s systems, services and programmes are designed and developed in line with security best practice and government standards. You will operate at the highest levels of the organisation, influencing critical architectural decisions and shaping long-term security strategy.

This is a highly influential and technically demanding role, combining expert-level security knowledge with strong leadership, stakeholder engagement and the ability to operate across complex environments. You will act as a trusted advisor, enabling teams to make informed, risk-based decisions while ensuring that security remains a key enabler of business outcomes.

• Leading the embedment of secure-by-design principles across application development and digital services, ensuring consistent and effective implementation
• Providing expert advice and internal consultancy on complex security architecture challenges across multiple projects and technologies
• Leading security architecture assurance activities, aligned with the Cyber Assessment Framework (CAF) and NCSC guidance
• Influencing strategic and architectural decisions, working closely with senior stakeholders across Ofgem and wider government
• Developing and shaping long-term security architecture strategies, principles and standards across the organisation
• Leading the secure development lifecycle, ensuring appropriate tooling, practices and capabilities are in place across engineering teams
• Overseeing application resilience and security posture across the IT estate, reviewing security reports and driving improvements
• Providing thought leadership on security tooling, including static and dynamic analysis, and embedding these into delivery pipelines
• Managing and maintaining risk registers, ensuring risks to security, privacy and resilience are understood, managed and reduced in line with organisational risk appetite
• Leading the assurance of security architecture artefacts for projects and guiding teams through secure delivery practices
• Managing third-party relationships and ensuring that security requirements are effectively embedded into contracts and supplier deliverables
• Supporting governance and reporting through forums such as Technical Design Authority, providing…