Security Architect (12 Month Fixed-Term Contract)

About the role

Allwyn UK, part of the Allwyn Entertainment Group, is hiring a Security Architect for a 12-month fixed-term contract within its Enterprise Security team. You will provide specialist security architecture for customer-facing and enterprise applications across web, mobile, API and cloud services, shaping secure designs from discovery through delivery and helping engineering teams embed security throughout the software development lifecycle.

Key responsibilities

• Provide security architecture support for mobile and web applications from discovery and design through build, testing, release and operation.
• Partner with solution architects, engineers, product teams and third parties so security is designed in early.
• Produce and maintain security designs, requirements, architecture decisions, patterns and assurance evidence.
• Lead threat modelling (e.g. STRIDE) and assess web apps, mobile apps, APIs, microservices, identity flows, cloud services and third-party integrations.
• Define security requirements for authentication, authorisation, session management, secrets, cryptography, data protection, API security, logging, monitoring and resilience.
• Advise on testing strategy (SAST, DAST, SCA, secrets scanning, API testing, IAST, penetration testing) and integrate security controls and automated testing into CI/CD pipelines.
• Review findings, prioritise remediation, produce test scopes and plans, and coach engineering communities on secure design.

Required profile

• Significant experience in application security architecture, product security or security engineering in an enterprise environment.
• Experience designing security for modern web, mobile and API applications, and threat modelling.
• Good understanding of secure SDLC, DevSecOps, Agile and CI/CD security.
• Experience with application security testing and with identity and access management.
• Strong written and verbal communication skills.

Required skills

• Web and API security (HTTP/S, CORS, CSP, REST, GraphQL); iOS and Android security.
• Tools such as Burp Suite, OWASP ZAP, Snyk or SonarQube.
• Cloud-native architecture (containers, serverless, microservices) and data flow assessment.
• Frameworks such as OWASP, NIST, ISO 27001, CIS and PCI DSS.
• Nice to have: regulated-environment experience, container/Kubernetes security, and certifications such as CISSP, CSSLP, SABSA, CREST or OSWE.