JDT Security Assurance Architect - secure on-site Hampshire

Job Description:

Security Architect (Joint Design Team)

Location: Farnborough, Hampshire, UK

Employment Type: Permanent, Full-Time

Travel: Up to 10% UK-wide and customer sites

Due to the nature of the work and the customers we support, the successful candidate must be eligible to meet UK Government and contractual personnel security requirements, including the applicable residency requirements for the role, and have the right to work in the United Kingdom. Some roles may also be subject to nationality requirements where these are necessary to meet UK Government or contractual security obligations.

About DXC Technology

DXC Technology is a Fortune 500 company delivering mission-critical IT solutions globally. Our Aerospace and Defence Hub in Farnborough works on sensitive defence programmes requiring highest security standards and rigorous assurance practices.

About the Role

The Security Architect (Joint Design Team) leads security architecture, design authority and assurance for defence and aerospace IT programmes. Acting as the security design authority within Joint Design Teams, you will define secure solution architectures and security patterns for proposed IT solutions, ensure solutions meet Secure by Design and JSP 440 (The Defence Manual of Security) requirements from the outset, identify security risks, and specify security controls. Working alongside the Client Delivery Team, Client risk owners and other suppliers, this role requires strong security knowledge, architectural judgement and the ability to lead and influence technical architects and Client teams.

Key Responsibilities

Security Architecture, Design & Assurance

• Act as security design authority, defining the security architecture, design patterns and security controls for proposed IT solutions against Client security requirements

• Develop and validate threat models and the security assumptions underlying IT designs

• Design security architectures for multi-classification environments (OFFICIAL, SECRET and above), including domain separation, cross-domain solutions and browse-down patterns

• Apply Zero Trust principles to secure on-premises, hybrid and cloud defence hosting designs

• Specify cryptographic architecture and key management approaches, including the use of National Cyber Security Centre (NCSC)-approved cryptographic products and the secure handling of cryptographic material

• Define emissions security (TEMPEST) and physical separation requirements for SECRET and above environments

Client Compliance & Standards Alignment

• Ensure IT designs are architected to comply with JSP 440 (The Defence Manual of Security), Client Secure by Design, Government Security Classifications Policy, Classification Guides, Def Stan 05-138 and NCSC guidance

• Embed UK export controls (Export Control Order 2008) and, where applicable, US International Traffic in Arms Regulations (ITAR) requirements into solution designs

• Embed supply-chain security requirements into solution designs, including supplier assurance, hardware and software provenance, and flow-down of Def Stan 05-138 obligations

• Design data handling and classification models, and address personnel security and vetting requirements within the design

Joint Design Team Leadership

• Lead security input to Joint Design Team meetings and architecture workshops, shaping infrastructure, network and application architecture decisions

• Review proposed solutions from a security perspective, challenge assumptions and design secure alternatives that embed Secure by Design principles early in the design phase

• Support security decision-making through architectural options analysis

• Integrate security across multi-supplier designs, coordinating with the Client Delivery Team, risk owners and other suppliers

Architecture Documentation & Reporting

• Produce security architecture and design documentation, including security specifications, control specifications and implementation guidance

• Create security requirements matrices and compliance traceability matrices

• Maintain the security architecture and its documentation through life, assessing the security impact of design changes after go-live

Risk-Driven Design & Mitigation Planning

• Conduct security risk assessments and use the outputs to prioritise architectural controls and inform design trade-offs

• Identify residual security risks, design appropriate mitigation strategies and track mitigation through implementation

• Lead risk management activities and produce Secure by Design evidence to support Client risk owners in accepting residual risk

Security Assurance & Validation

• Define security test plans and assurance approaches that demonstrate security controls operate as designed

• Validate implementation of security controls against the approved security architecture

• Lead the security architecture contribution to Secure by Design assurance activities

Stakeholder Engagement & Influence

• Lead security design discussions with Client security teams, communicating architecture decisions, their implications and executive summaries clearly to technical and non-technical stakeholders

• Represent security at design reviews and programme governance boards, defending architectural decisions

Essential Requirements

Experience & Expertise

• Minimum 8 years' information security experience, including a security architecture or design assurance role

• Demonstrated experience designing secure solutions across on-premises, hybrid and cloud environments, and leading security design reviews

• Strong background in defence, aerospace or national security programmes

• Experience delivering Secure by Design (or equivalent security assurance) outcomes

• Experience providing technical leadership or acting as security design authority in a security or Joint Design Team function

• Strong expertise in IT architecture and design principles, security reference architectures and architecture frameworks (e.g. SABSA, TOGAF)

• Eligible for, and willing to undergo, DV clearance

Technical Knowledge

• Strong knowledge of IT security controls and network, infrastructure, application and data security

• Strong knowledge of multi-classification architectures, cross-domain solutions and Zero Trust principles

• Working knowledge of communications security (COMSEC) and NCSC-approved cryptographic products

• Strong knowledge of threat modelling and risk assessment methodologies

• Working knowledge of MOD security requirements as applied to industry (e.g. Security Aspects Letters, Defence Conditions (DEFCONs), Def Stan 05-138 and GovS 007: Security), MOD Secure by Design, Government Security Classifications Policy and MOD Classification Guides

• Working knowledge of UK export controls and, where applicable, ITAR requirements

• Working knowledge of security standards (Cyber Essentials Plus, NCSC guidance, ISO/IEC 27001, NIST SP 800-53 and the NIST Cybersecurity Framework (CSF))

Personal Attributes

• Strong architectural thinking, analytical and problem-solving skills, with the ability to identify design gaps, inconsistencies and security trade-offs

• Strong technical leadership and influencing skills, with a collaborative approach to working with architects and technical teams

• Excellent written and verbal communication skills, including the ability to explain complex security concepts clearly

• Confidence to make, defend and challenge design decisions on security grounds

Desirable Requirements

• Current, active DV clearance enabling an immediate start

• CISSP, CISM, SABSA, UKCSC Security Architecture or equivalent security certification

• Experience applying the NCSC Cyber Assessment Framework (CAF)

• Knowledge of Common Criteria or other formal security evaluation frameworks

• Hands-on experience of COMSEC arrangements and the deployment of NCSC-approved (high-grade) cryptographic products

• Working knowledge of emissions security (TEMPEST) and supply-chain security in a defence context

• Experience using the MOD-mandated NATO Architecture Framework (NAF) v4

• Familiarity with defence acquisition and programme delivery lifecycles (e.g. CADMID/CADMIT)

• Background in systems engineering or infrastructure engineering

What We Offer

• Competitive salary and benefits package

• Enhanced pension and private medical insurance

• Flexible working arrangements, noting this role is based on a customer site with onsite attendance during the working week

• Professional development and security training support, including training in specialist areas such as TEMPEST, supply-chain security and NAF v4 where required

• Opportunity to work on high-impact defence programmes

• Exposure to cutting-edge defence technology and security challenges

Application Process & Security Vetting

Applicants should be aware that:

• An offer of employment is subject to satisfactory completion of background checks and security vetting

Equal Opportunities

DXC Technology is an equal opportunities employer committed to building diverse, inclusive teams. We welcome applications from all backgrounds and are committed to creating an inclusive recruitment process.

At DXC Technology, we believe strong connections and community are key to our success. Our work model prioritizes in-person collaboration while offering flexibility to support wellbeing, productivity, individual work styles, and life circumstances. We’re committed to fostering an inclusive environment where everyone can thrive.

Recruitment fraud is a scheme in which fictitious job opportunities are offered to job seekers typically through online services, such as false websites, or through unsolicited emails claiming to be from the company. These emails may request recipients to provide personal information or to make payments as part of their illegitimate recruiting process. DXC does not make offers of employment via social media networks and DXC never asks for any money or payments from applicants at any point in the recruitment process, nor ask a job seeker to purchase IT or other equipment on our behalf. More information on employment scams is available here.