Security Architect

Capital.com is a global fintech company with over 1,000,000 clients worldwide. Our platform offers CFD trading across 5,000+ markets, powered by proprietary AI technology that helps traders make better decisions. Our top-rated products have won prestigious industry awards for their cutting-edge technology and seamless client experience. We deliver only the best, so we are always in search of the best people to join our ever-growing talented team.

As part of our continued investment in security and regulatory resilience, we are seeking a Security Architect to own the design of our enterprise security governance, risk, and compliance (GRC) framework. This is a senior, high-visibility role that sits at the intersection of security architecture, multi-jurisdiction regulatory compliance, and organizational risk — shaping how a global fintech company regulated across five jurisdictions thinks about, measures, and reduces security risk.

Responsibilities:

• Own the enterprise security GRC framework — policy hierarchy, risk register methodology, control ownership, and audit evidence structure.

• Map controls to DORA, NIS2, ISO 27001, and PCI-DSS, identify gaps, and set remediation priority.

• Act as the final authority on regulatory interpretation affecting security, including written positions for audits and regulatory submissions.

• Own the compliance and obligation management framework across all five regulated jurisdictions (FCA, CySEC, ASIC, SCB, SCA), including regulatory horizon scanning.

• Represent the company in regulatory discussions alongside the CISO and General Counsel where required.

• Define the company's human-risk philosophy and shape the security awareness architecture — segmentation, interventions, and measurement.

• Advise the CISO, CHRO, Risk, and Compliance teams on security risk, regulatory obligations, and investment trade-offs.

• Set the architectural standards the Corporate Security team executes against, and sign off on significant framework changes.

• Support Third-Party Risk Management and Business Continuity & Crisis Management from a security and technical perspective.

Requirements:

• 8+ years in security with a significant focus on GRC, regulatory compliance, riskmanagement, or a combination — with a track record of owning these programs at enterpriselevel, not just familiarity with them.

• Proven experience designing enterprise-level security architectures or frameworks;experience in a regulated financial services environment (brokerage, payments, banking, orequivalent) is preferred but not required.

• Deep command of ISO 27001 and PCI-DSS (working knowledge of DORA and NIS2preferred), with the ability to translate regulatory text into specific controls, identify gaps, anddetermine what is mandatory versus discretionary.

• Multi-jurisdiction compliance experience; direct exposure to FCA or CySEC is a strongadvantage.

• Demonstrated ability to advise and influence C-suite stakeholders on complex security andregulatory matters.

• A structured, analytical thinking style — able to hold multiple regulatory regimessimultaneously without losing precision on any of them.

• Fluent English, written and spoken.

Nice to have:

• Direct experience managing regulatory submissions or engaging with supervisory authorities(FCA, CySEC, ASIC, SCB, or SCA).

• TPRM program design experience, including DORA ICT third-party risk requirements andsupply chain risk.

• Business Continuity Management background, with experience meeting operational resilienceobligations and presenting at Board level.

• Security awareness program design with measurable behaviour-change outcomes.

• Experience building or scaling a Corporate Security function from an early stage.

• Relevant professional certifications (CISSP, CISM, CRISC, or equivalent).

Department: Technology
Team: Security - CorpSec