Quantum Cryptography Architect

We are looking for a mid-to-senior level Information Security Architect to join our Security Architecture team at Starling Bank. The successful candidate will lead our Post-Quantum Cryptography (PQC) initiative, designing our crypto-inventory, evaluating PQC algorithms, and defining our technical roadmap to keep Starling resilient against emerging future threats.

Responsibilities:

• Lead our Post-Quantum Strategy: Take ownership of Starling’s Post-Quantum Cryptography (PQC) initiative over the coming years; designing our crypto-inventory, evaluating PQC algorithms, and designing architectures built for cryptographic agility.
• Act as the Cryptography SME: Provide expert architecture and design guidance on Public Key Infrastructure (PKI), Hardware Security Modules (HSMs), key management, service mesh security, and transport layer protocols across our cloud environments.
• Enterprise Architecture Delivery: Architect secure, scalable solutions across AWS and GCP, translating complex security requirements into simple, pragmatic design patterns for engineering teams.
• Secure Architecture Governance: Lead and assist with secure design reviews and threat modeling initiatives, delivering actionable security guidance and continuous support to Engineering teams.
• Proof of Concept Development: Design and build PoC solutions for engineers to refine or draw inspiration from.
• Collaborate & Influence: Work closely with software engineers, cloud architects, and security operations to review RFCs and ADRs, conduct threat models, and embed security seamlessly into the development lifecycle without adding friction.
• Drive Thought Leadership: Serve as a trusted advisor within our growing Security Architecture team, staying ahead of industry trends, threat vectors, and regulatory standards to elevate Starling's overall security posture.

Requirements:

• Security Architecture Experience: Proven track record in a Information Security Architect or Senior Security Engineering role designing secure, distributed systems within modern cloud environments (AWS/GCP).
• Deep Cryptography Expertise: Comprehensive practical and theoretical knowledge of symmetric/asymmetric cryptography, PKI management, digital signatures, key management systems (KMS), and HSMs.
• Post-Quantum Cryptography (PQC) Knowledge: Strong understanding of quantum computing threats to modern encryption, NIST PQC standards, hybrid key exchange, and strategies for achieving crypto-agility.
• Threat Modeling & System Design: Demonstrated ability to perform threat modeling on complex cloud-native applications, APIs, and microservices architectures (e.g. Kubernetes, ECS).
• Pragmatic Problem Solver: A firm believer that security should enable engineering speed, with the ability to design security controls that minimise developer friction.
• Communication & Collaboration: Excellent written and verbal communication skills, with a track record of distilling complex technical/cryptographic risks into clear guidance for both technical teams and senior leadership.