Security Architect

About the role

Capital.com is seeking a senior Security Architect to lead the design and implementation of its enterprise security governance, risk and compliance (GRC) framework across multiple regulated jurisdictions. This high‑visibility role sits at the intersection of security architecture, regulatory compliance and organizational risk.

Key responsibilities

• Own the enterprise security GRC framework, including policy hierarchy, risk register methodology, control ownership and audit evidence structure.
• Map controls to DORA, NIS2, ISO 27001 and PCI‑DSS, identify gaps and set remediation priorities.
• Act as the final authority on regulatory interpretation affecting security and provide written positions for audits and regulatory submissions.
• Manage the compliance and obligation framework across five regulated jurisdictions (FCA, CySEC, ASIC, SCB, SCA) and conduct regulatory horizon scanning.
• Represent the company in regulatory discussions alongside the CISO and General Counsel when required.
• Define the human‑risk philosophy and shape the security awareness architecture, including segmentation, interventions and measurement.
• Advise the CISO, CHRO, Risk and Compliance teams on security risk, regulatory obligations and investment trade‑offs.
• Set architectural standards for the Corporate Security team and sign off on significant framework changes.
• Support Third‑Party Risk Management and Business Continuity & Crisis Management from a security and technical perspective.

Required profile

• 8+ years of experience in security with a strong focus on GRC, regulatory compliance or risk management, and a proven track record of owning enterprise‑level programs.
• Demonstrated experience designing enterprise‑level security architectures or frameworks; experience in a regulated financial services environment is a plus.
• Deep knowledge of ISO 27001 and PCI‑DSS (working knowledge of DORA and NIS2 preferred) with the ability to translate regulatory text into specific controls.
• Multi‑jurisdiction compliance experience; direct exposure to FCA or CySEC is a strong advantage.
• Proven ability to advise and influence C‑suite stakeholders on complex security and regulatory matters.
• Structured, analytical thinking style.

Required skills

• ISO 27001
• PCI‑DSS
• DORA
• NIS2
• GRC frameworks
• Regulatory compliance
• Risk management