Principal Security Architect

Across government, cyber security is no longer confined to protective controls at the edge of systems; it is fundamental to how organisations design, build and operate secure digital services.

As technology estates become increasingly complex and cloud adoption accelerates, the need to embed security from the outset,through consistent, architecture-led approaches,has never been more critical.

At Ofgem, secure-by-design principles are central to ensuring that digital transformation is delivered safely, resiliently and in line with regulatory and national security expectations.

Ofgem plays a vital role in protecting energy consumers and enabling the UK’s transition to a more secure, fair and sustainable energy system.

As the organisation continues to modernise its digital, data and technology capabilities, cyber security must be fully integrated into every layer of design and delivery.

Within the Digital, Data and Security Services (DDSS) directorate, we are strengthening our enterprise security architecture capability, embedding robust secure design practices and aligning with cross-government and National Cyber Security Centre (NCSC) standards.

As Principal Security Architect, you will provide enterprise-wide leadership for secure design across Ofgem’s digital platforms, data systems and cloud environments.

Sitting within Enterprise Architecture under the CTO, you will act as the senior authority on security architecture, ensuring that programmes, products and services adopt consistent, standards-based approaches to security from inception through to delivery.

This is a highly influential role with significant strategic impact.

You will define and shape Ofgem’s secure design vision, principles and frameworks, while leading architectural assurance across complex, high-risk systems.

You will operate at the intersection of technology, risk and business strategy,balancing innovation and delivery with strong governance, compliance and resilience.

Responsibilities:

• Setting the strategic direction for secure design across Ofgem, establishing enterprise-wide frameworks, principles and architectural patterns that ensure consistency and resilience
• Acting as the senior authority for security architecture, leading assurance for major programmes and providing expert guidance on complex, high-risk systems
• Leading architectural reviews and embedding secure development lifecycle practices, including threat modelling, code analysis and resilience testing across the technology estate
• Ensuring alignment with government security standards and NCSC guidance, integrating risk management into architectural decision-making
• Building strong relationships with senior stakeholders across technology, security and the wider organisation, influencing decisions and shaping secure-by-design outcomes
• Driving innovation in security architecture, evaluating and adopting new tools, technologies and methodologies to enhance automation and effectiveness
• Establishing and leading governance processes for security design, including review boards and assurance forums for major projects
• Developing the security architecture capability within Ofgem, mentoring and supporting architects and contributing to the wider Government Security Profession

Requirements:

• Chartered via the UK CSC or CISSP or equivalent
• Deep technical understanding of IT infrastructure / Software development and management of these components
• Experience of engaging, advising and influencing at all levels of an organisation whilst projecting credibility and self-assurance – specifically relating to intelligence analysis and risk management
• Experience of developing and implementing a pragmatic approach to assessing the security, privacy and resilience risks affecting sensitive assets, including engaging stakeholders to create shared understanding of the risks
• Experience of managing the implementation of strategic plans, tracking progress on risk reduction and benefits delivery; and managing changes to plans line with identified delivery risks and issues
• Experience of negotiating and managing 3rd party contracts and acting as an intelligent customer, ensuring that security, privacy and resilience are negotiated into the agreed contract terms and conditions

Desirable Criteria:

• Experience of defining and gaining approval for a viable, agile and pragmatic security, privacy and resilience strategy capable of responding to and anticipating changes to the assessed threats, risks and business environment
• Experience in analysing incidents across a complex environment
• Experience of developing a business case for change that identifies the business benefits of a defined security, privacy and resilience strategy

Benefits:

Alongside your salary of £63,443, OFGEM contributes £18,379 towards you being a member of the Civil Service Defined Benefit Pension scheme.

Ofgem can offer you a comprehensive and competitive benefits package which includes;

• 30 days annual leave after 2 years
• Excellent training and development opportunities
• The opportunity to join the generous Civil Service pension which also includes a valuable range of benefits
• Hybrid working (currently 1 day a week in the office but this is kept under review)
• Flexible working hours and family friendly policies
• Clean and bright offices based centrally
• Engaged networks and teams
• An opportunity to contribute to our ambitious and important targets of establishing a Net Zero energy system by 2050