Security Architect - Zero Trust & Access Controls

We are seeking an experienced Security Architect - Zero Trust & Access Controls to join our rapidly evolving financial services organisation. This role will be instrumental in shaping and securing our digital future as we undergo significant transformation across our technology landscape. The position will focus primarily on securing customer interactions and fraud prevention while championing security-by-design principles across our product development lifecycle.

You will be required to have a strategic input into enterprise IAM security architecture, with a direct influence on the security posture of our customer-facing services. Additionally, you will provide mentorship and guidance to our security architects, product security specialists and product development teams. What you'll be doing Strategic Leadership Lead the development and evolution of enterprise IAM frameworks and patterns for customer-facing (Client) and workforce (Colleague) identity solutions across on-premises, colocation, SaaS, AWS, and Azure environments.

Drive zero-trust architecture adoption and security-by-design principles across all product development and engineering initiatives. Provide thought leadership in cloud IAM, federated identity, privileged access management, and identity governance for hybrid multi-cloud environments. Architecture & Design Design and oversee robust IAM architectures spanning:
On-premises:
Active Directory, AD FS, RADIUS/LDAP integrations. Colocation:
Hybrid identity sync, network-level authentication. SaaS:
Okta, Ping Identity, Auth0, Azure AD B2C. AWS: IAM, Identity Center, Organizations, Cognito, Secrets Manager. Azure:
Entra , Conditional Access, PIM, Key Vault, Managed Identities. Develop reference architectures for OAuth 2.0, OIDC, SAML 2.0, FIDO2/Web Authn, and passwordless authentication flows. Review and approve identity designs for critical systems including API security, service-to-service authentication, and customer authentication journeys. Establish controls for identity lifecycle, access governance, JIT/JEA access, and privileged account management. Digital Transformation Align IAM architecture with agile delivery, Dev Sec Ops  practices, and infrastructure-as-code approaches.

Design identity controls enabling risk-based authentication, adaptive MFA, and continuous authorisation. Develop migration strategies from legacy IAM systems to modern cloud-native platforms. Governance & Risk Management. Participate in security governance forums, design authority and architecture review boards. Conduct IAM assessments, access reviews, segregation of duties analysis, and privilege escalation risk reviews. Ensure regulatory compliance (GDPR, PSD2, DORA) through identity controls and access certification.

About you Extensive experience in security architecture with deep IAM, preferably within the Financial Services Industry. Proven experience in designing and implementing IAM solutions. Deep understanding of cloud security architecture and control (AWS, Azure).

Experience with modern authentication protocols (OAuth 2.0, OIDC, SAML) and fraud prevention technologies. Extensive knowledge and expertise on securing mobile apps, API transactions and system integrations with optimal combination of security capabilities. Knowledge of application cryptography, PKI infrastructure and use of mobile TEE. Strong communication and stakeholder management skills, with the ability to translate complex technical concepts for non-technical audiences. Able to work under pressure in a fast paced, transformation-focused environment.

Bachelor's degree in computer science, Information Security, or related field. Relevant certifications (highly desirable) Certified Professional - Ping*. Cyber Ark Sentry - Any. Certified Identity and Access Manager (CIAM). AWS Certified Security Specialty. Microsoft Certified:
Security, Compliance, and Identity Fundamentals (SC-900). Microsoft Certified:
Identity and Access Administrator Associate (SC-300). Interview process This will be a 2-stage interview process, consisting of an intro call, competency and behavioural based interview with technical assessment. Working Schedule We are based in Bristol, BS1 5HL
. This role is permanent, full time, 37.5 hours per week, Monday to Friday. We have returned to the office, however for this role we offer a hybrid flexible working pattern to enable you the option of working from home. Why us? Here at HL, we're the UK's number 1 investment platform for private investors, based in Bristol. For more than 40 years we've helped investors save time, tax and money on their investments.

To achieve our mission, we believe we have a workplace like no other, with constant learning, dynamic teams, and a great ethos. We're steered by core values that promote service, quality, innovation, and opportunity in everything we do. What's on offer? Discretionary annual bonus
* and annual pay review 25 days
* holiday plus bank holidays and 1-day additional Christmas…