Lead Security Architect

We are currently looking for aLead Security Architectto join our Strategy & ArchitectureFunction within the Digital & Technologygroup.

This is a full-time opportunity on a permanent basis. The role will be based in 7/8 Wellington Place Leeds LS1 4AP.

Government departments and agencies are working towards implementing a minimum 60% attendance in office sites.

We are currently implementing a flexible hybrid way of working with a minimum of 8 days per month working on site to enable the collaboration and contact with partners and stakeholders needed to deliver MHRA business. Attendance on site is driven by business needs so depending on the nature of the role this can flex up to 12 days a month with the remainder of time worked either remotely or in the office. Some roles will need to be on site more regularly. Please discuss this with the recruiting manager before accepting an appointment.

In recognition of the need to attract and retain employees with specialist skillsthis role attracts a Market Pay Supplement of up to 22802 per annum. This non-contractual supplement is reviewed at the end of the probation period and thereafter annually and is non-pensionable.

Who are we

The Medicines and Healthcare products Regulatory Agency enhance and improve the health of millions of people every day through the effective regulation of medicines and medical devices underpinned by science and research.

The Digital and Technology Group (DTG) lies at the heart of the Agency and is responsible for delivering an optimised IT infrastructure and maximising the secure use of data to enable our scientists inspectors and the rest of the organisation to deliver world class services which can improve outcomes for patients and thegeneral public. The Group was essential in the race to approve COVID-19 vaccines in 2020 and in supporting the UK to set up its own medicines and devices approvals systems following our exit from the EU. The work we do matters!

Its centre of excellence is also responsible for delivering a broad portfolio of change initiatives both to transform the Agencys legacy technologies and to deliver innovativenew solutions designed around our customers needs. DTG works in a holistic way to combine digital and technology change data and information management project delivery business process productmanagementand cultural change to maximise out impact and ensuresustainability.

We plan to be at the heart of one of the most digitally advanced medical regulators in theworldand we need people who can help us deliver that ambition. DTG isa great placeto build your career and we are committed to enabling our people to do the best work of their lives.

Whats the role

As an IT Security Architect you will play a critical role in safeguarding the departments IT infrastructure and sensitive data responsible for designing building and maintaining robust security architectures that protect the departments systems from threats and vulnerabilities.

Your primary goal is to ensure that all IT services and solutions are secure by design and compliant with government security policies and standards.

This role requires a strategic thinker with deep technical expertise knowledge an understanding of emerging threats and the ability to work collaboratively with various stakeholders to embed security principles throughout the IT landscape. You will work closely with various stakeholders including business leaders IT teams and external partners to develop and implement security strategies that align with the departments objectives and regulatory requirements.

Key responsibilities:

• Security Architecture Design

• Security Policy Development and Compliance

• Security Awareness and Training

• Stakeholder Engagement and Collaboration

• Innovation and Continuous Improvement

Who are we looking for

Oursuccessful candidatewill:

• Developand maintain a comprehensive Security Architecture framework that aligns with the IT strategy government policies and best practices.

• Develop implement and maintain security policies standards and procedures in line with government regulations industry standards and departmental needs ensuring that all IT systems and solutions comply with relevant legal regulatory and governmental standards such as GDPR Cyber Essentials Secure By Design.

• Collaborate with cross-functional teams to ensure security is integrated into all aspects of the Agencys digital transformation initiatives.

• Stay abreast of industry trends emerging technologies and best practices in Technical Architecture bringing forward recommendations for improvement.

Person Specification:

Method of assessment:AApplication TTest IInterview PPresentation

Behaviour Criteria:

• Leadership (I)

• Making Effective Decisions (I)

• Working Together (I)

• Communicating and Influencing (P)

Experience Criteria:

• Extensive experience designing implementing and managing the security architecture for large complex organisations with deep expertise in security architecture principles including defence in depth zero trust least privilege and secure by design approaches (A I P)

• Strong risk and assurance capability including conducting risk assessments and threat modelling developing risk management strategies and leading internal and external security audits assessments and penetration testing aligned to frameworks such as CAF and NIST (A I)

• Proven track record in security governance and continuous improvement including developing and maintaining security policies standards and procedures in line with industry best practice and applying up to date knowledge of emerging threats vulnerabilities and trends to strengthen organisational security posture (A)

Technical Criteria:

• Experience in designing and implementing secure network architectures including knowledge of network protocols segmentation firewalls VPNs and intrusion detection/prevention systems (IDS/IPS) in on-premise and cloud environments (A P)

• Demonstrable experience with a range of security technologies and tools including but not limited to: (A)

  • Identity and Access Management (IAM) SIEM tools endpoint protection and cryptography and encryption solutions Data Protection and Privacy Controls Vulnerability Management Security Orchestration Automation and Response (SOAR) Tools Secure Mobile and Endpoint Computing and securing web applications APIs and microservices

• Degree level or significant professional experience (A)

• Desirable: Familiarity with UK public sector regulations standards and frameworks such as the Government Digital Service (GDS) Secure by Design Cyber Essentials NCSC guidelines GDPR and ISO/IEC 27001 (A)

• Desirable:Security qualification e.g. CISSP SABSA (A)

If you would like to find out more about this fantastic opportunityplease read our Job Description and Person Specification!

Please note: The job description may not open in some internet browsers. Please use Chrome or Microsoft Edge. If you have any issue viewing the job description please contact

The selection process:

We use the Civil Service Success Profiles to assess our candidatesfind out more here.

• Online application form including questions based on theBehaviour Experience and Technical Success Profiles.Please ensure all application questions are completed in full; your application may not be considered if any responses are left blank. Our applications are CV blind and our Hiring Managers will not be able to access your CV when reviewing your application.

• Presentation to be prepared as part of your interview with further information being supplied when you reach this stage.

• Interview which can include questions based on theBehaviour Experience Technical and Strengths Success Profiles.

In the instance that we receive a high number of applications we will hold an initial sift based on the lead criteria of Extensive experience designing implementing and managing the security architecture for large complex organisations with deep expertise in security architecture principles including defence in depth zero trust least privilege and secure by design approaches.

Applicants are assessed on whether they meet any mandatory requirements as well as the necessary skills and experience for the role. Applications are scored based on the competency-based answers provided- ensure you have read these thoroughly and allowsufficienttime. You can view the competencies for this role in the job description.

Use of AI in Job Applications

Artificial Intelligence can be a useful tool to support your application however all examples and statements provided must be truthful factually accurate and taken directly from your own experience. Where plagiarism has been identified (presenting the ideas and experiences of others or generated by artificial intelligence as your own) applications may be withdrawn and internal candidates may be subject to disciplinary action. Please see ourcandidate guidancefor more information on appropriate and inappropriate use.

If you require any disability related adjustments at any point during the process please contact as soon as possible.

Closing date:6^th September 2026

Shortlisting date: from 11^th September 2026

Interview date:from 28^th September 2026

If you need assistance applying for this role or have any other questionsplease contact

Candidates will be subject to UK immigration requirements as well as Civil Service nationality information on whether you are able to apply is availablehere.

Successful candidates must pass a disclosure and barring security check as well as animal rights and pro-life activism checks. People working with government assets must completebasic personnel security standard checks.

Certain roles within the MHRA will require post holders to have vaccinations and in some circumstances routine health surveillance. These roles include:

• Laboratory-based roles working directly with known pathogens

• Maintenance roles particularly those required to work in laboratory settings

• Roles that involve visiting other establishments where vaccination is required

• Roles required to travel overseas where specific vaccination may be required.

Applicants who are successful at interview will be as part of pre-employment screening subject to a check on the Internal Fraud Database (IFD). This check will provide information about employees who have been dismissed for fraud or dishonesty offences. This check also applies to employees who resign or otherwise leave before being dismissed for fraud or dishonesty had their employment continued. Any applicants details held on the IFD will be refused employment. A candidate is not eligible to apply for a role within the Civil Service if the application is made within a 5 year period following a dismissal for carrying out internal fraud against government.

Any move to the MHRA from another employer will mean you can no longer access childcare vouchers. This includes moves between government departments. You may however be eligible for other government schemes including Tax-Free Childcare. Determine your eligibilityhere.

Individuals appointed on level transfer will retain their existing salary and are responsible for ensuring they fully understand the financial implications of any potential move and the impact (if any) on their terms. If an individual is in any doubt they should seek clarification before accepting a job offer.

Staff joining on promotion will receive up to a 10% increase of their current basic salary or the pay band minimum whichever is the greater.

The individual will not retain any allowances paid by the former department/Agency unless there are special circumstances such as a reserved right to those allowances on transfer.

Successful candidates may be subject to annual Occupational Health reviews dependent on role requirements. If you have any queries please contact.

In accordance with the Civil Service Commissioners Recruitment Principles our recruitment and selection processes are underpinned by the requirement of selection for appointmenton the basis ofmerit by a fair and open competition. If you feel your application has not been treated in accordance with the Recruitment Principles and you wish to make a complaint in the first instance you should contact the MHRA Recruitment Team at.

If you are not satisfied with the response you receive you can contact the Civil Service Commission at:

Civil Service Commission

Room G/8

1Horse Guards Road

London

SW1A 2HQ