Senior Cloud & SaaS Architect (Application Security Focus) - Manchetser
About Finova
Finova is the UK’s largest financial services technology provider, supporting one in every five mortgages nationwide. Our agile, cloud-native solutions enable over 60 banks, building societies, specialist lenders, equity release providers and a network of 2,400+ brokers to stay ahead in a competitive market.
Built on open architecture and backed by deep industry expertise, our platform is designed to scale. Each year, we process over £50 billion in loans, manage nearly £50 billion in savings, and support the digital servicing of more than 650,000 UK borrower accounts.
Be part of a team that’s driving innovation, enabling growth and shaping the future of UK lending.
For Lenders
Finova offers a flexible, modular technology suite designed to help lenders move faster, scale efficiently and deliver standout digital experiences.
Financial Institutions use Finova to launch products faster, process applications up to 50% more efficiently and reduce operational costs — all while staying fully compliant in a fast‑moving market.
About the Role
We're looking for a Senior Cloud & SaaS Architect with deep application security instincts and a forward‑looking understanding of AI‑driven product development. In a fintech SaaS company, the attack surface isn't just the infrastructure — it's the application layer: the APIs customers call, the authentication flows they depend on, the tenant boundaries that keep their data separate, the AI models that power intelligent features, and the code that processes their financial transactions.
AI is central to our product strategy — from fraud detection and risk scoring to conversational interfaces and intelligent automation. This creates architectural challenges that don't exist in traditional SaaS: how do you enforce tenant data isolation when training and serving ML models? How do you secure LLM‑powered features against prompt injection? How do you maintain auditability when decisions are made by probabilistic systems in a regulated financial environment?
This role sits at the intersection of SaaS platform design, cloud architecture, application security, and AI infrastructure. You'll define the security architecture that product and AI teams build on top of, embedding secure defaults into every layer from tenant provisioning to model serving to API response handling.
What You'll Do
Application Security Architecture
* Define the application security architecture across the full SaaS stack — from client‑facing APIs to backend services to AI/ML pipelines to data persistence layers.
* Design and enforce secure authentication and authorization patterns: OAuth 2.0 / OIDC flows, token lifecycle management, tenant‑scoped RBAC/ABAC, and session handling.
* Architect API security controls — input validation frameworks, output encoding, rate limiting, request signing, and abuse prevention — as platform‑level primitives, not per‑team afterthoughts.
* Own the secure software development lifecycle (SSDLC): threat modeling processes, secure code review standards, and security acceptance criteria for feature delivery.
* Design and maintain an application‑layer secrets management strategy — how services authenticate to each other, how credentials rotate, and how keys are scoped per tenant.
* Lead threat modeling sessions for new features, integrations, and architectural changes, with specific focus on OWASP Top 10, business logic flaws, and cross‑tenant attack vectors (IDOR, privilege escalation, data leakage).
* Define the vulnerability management lifecycle — how findings from SAST, DAST, SCA, and pen tests are triaged, prioritized, tracked, and verified as resolved.
* Architect runtime application security controls: WAF rules, bot detection, anomaly detection, and real‑time transaction monitoring for fraud‑adjacent patterns.
AI & ML Architecture and Security
* Design the architecture for AI/ML workloads — model training pipelines, feature stores, model serving infrastructure, and feedback loops — with tenant isolation and data governance built in from the start.
* Architect secure integration patterns for LLM‑powered features: sandboxed execution, prompt injection defenses, output filtering, and guardrails that prevent model outputs from leaking tenant data or producing harmful financial guidance.
* Define tenant data isolation strategies for AI pipelines — ensuring training data, embeddings, vector stores, and model fine‑tuning respect tenant boundaries and comply with data processing agreements.
* Design AI observability and auditability: logging model inputs/outputs, decision tracing for regulatory explainability, drift detection, and bias monitoring in financial decision models.
* Architect the infrastructure for responsible AI in a regulated environment — human‑in‑the‑loop workflows for high‑stakes financial decisions, model versioning, rollback capabilities, and A/B testing frameworks.
* Evaluate and integrate third‑party AI services (LLM APIs, embedding providers) with appropriate security controls: data minimization, contractual protections, and fallback strategies for vendor outages or policy changes.
* Stay ahead of the evolving AI threat landscape — adversarial attacks on ML models, data poisoning, model extraction, and emerging OWASP AI/ML security risks.
SaaS Platform Design
* Define the multi‑tenancy strategy (silo, pool, or bridge) with application security as a primary driver — not just cost or operational convenience.
* Design tenant isolation at the application layer: query‑scoping, row‑level security, context propagation, and tenant‑aware middleware that prevents cross‑tenant data access by default.
* Architect tenant onboarding, provisioning, and deprovisioning flows with security controls baked in — ensuring no orphaned access, no stale credentials, and full auditability.
* Design the SaaS control plane with least‑privilege principles: entitlements, feature flags, and metering systems that enforce boundaries, not just track usage.
* Shape the platform's API strategy — versioning, deprecation policies, developer‑facing auth (API keys, OAuth client credentials), and webhook signature verification.
* Design AI‑as‑a‑feature platform primitives — so product teams can safely embed AI capabilities (recommendations, risk scores, natural language interfaces) without each team solving tenant isolation and compliance independently.
Cloud Architecture & Infrastructure Security
* Own the multi‑cloud architecture across AWS, Azure, and GCP with a security‑in‑depth posture at every layer.
* Design network segmentation, service mesh policies, and zero‑trust connectivity between services — ensuring east‑west traffic is authenticated and authorized, not just north‑south.
* Architect GPU/accelerator infrastructure and model serving platforms (SageMaker, Vertex AI, Azure ML, or self‑hosted) with cost governance and security controls appropriate for financial data.
* Implement infrastructure‑as‑code with integrated security scanning (tfsec, Checkov, Bridgecrew) and policy‑as‑code enforcement (OPA, Sentinel).
* Design encryption strategies: at rest (tenant‑scoped KMS keys where required), in transit (mTLS between services), and in use where applicable for sensitive financial data and AI training sets.
* Architect CI/CD pipelines with embedded security gates — SAST, DAST, SCA, container image scanning, and IaC validation — that block deployments on critical findings without creating bottlenecks.
Compliance & Governance
* Translate SOC 2 Type II, PCI‑DSS, and other regulatory requirements into concrete architectural controls and automated evidence collection.
* Address emerging AI governance and regulatory requirements — EU AI Act readiness, model risk management frameworks, and algorithmic accountability in financial services.
* Design audit logging and tamper‑evident trails at the application layer — who accessed what data, when, through which API, with what authorization context — including AI model decisions and their inputs.
* Ensure data residency, retention, and deletion controls are architecturally enforced across both traditional data stores and AI‑specific storage (vector databases, feature stores, training datasets).
* Partner with GRC, Legal, and Security teams on audit readiness, penetration test scoping, and incident response architecture.
Engineering Culture & Enablement
* Build the "paved road" — secure‑by‑default libraries, frameworks, and templates that make the secure path the easiest path for developers, including safe patterns for AI feature integration.
* Run security champions programs, lunch‑and‑learns, and hands‑on workshops to raise application security and AI security literacy across engineering.
* Mentor engineers on secure coding, threat modeling thinking, AI safety patterns, and security trade‑off analysis.
* Collaborate with Product on security‑relevant UX decisions: consent flows, data visibility controls, admin privilege models, and AI transparency features (explainability, confidence indicators).
* Define and track application security metrics: mean time to remediate, vulnerability escape rate, coverage of threat models, AI‑specific incident rates, and security debt trends.
What You Bring
Must‑Have
* 7+ years in cloud architecture or security engineering, with at least 3 years focused on application security in a SaaS environment.
* Deep understanding of application security principles — OWASP Top 10 is a starting point, not the ceiling. You think in terms of business logic flaws, trust boundaries, and data flow analysis.
* Proven experience designing multi‑tenant systems with security as a primary architectural driver, including tenant isolation patterns at the application and data layers.
* Hands‑on experience with at least two of AWS, Azure, and GCP; working familiarity with all three.
* Working knowledge of AI/ML infrastructure — model training pipelines, serving architectures, vector databases, and LLM integration patterns. You don't need to be a data scientist, but you need to architect systems that AI teams build on securely.
* Understanding of AI‑specific security risks: prompt injection, data poisoning, model leakage, and the unique compliance challenges of using AI in regulated financial services.
* Strong background in authentication and authorization architecture: OAuth 2.0, OIDC, SAML, JWTs, RBAC/ABAC, and token management at scale.
* Experience embedding security into CI/CD pipelines — SAST (Semgrep, SonarQube, Checkmarx), DAST (Burp, ZAP), SCA (Snyk, Dependabot), and container scanning.
* Expertise in infrastructure‑as‑code (Terraform, Pulumi) with integrated security policy enforcement.
* Track record working within compliance frameworks (SOC 2, PCI‑DSS, ISO 27001) and translating controls into automated, auditable architecture.
* Ability to communicate security trade‑offs to engineers in terms of risk and velocity, not fear — and to explain AI architectural decisions to executive stakeholders in business terms.
Nice‑to‑Have
* Experience in fintech, payments, banking, or insurance SaaS products.
* Hands‑on experience with ML platforms (SageMaker, Vertex AI, Azure ML) and LLM orchestration frameworks (LangChain, LlamaIndex, or similar).
* Experience designing RAG (Retrieval‑Augmented Generation) architectures with tenant‑scoped data isolation.
* Familiarity with AI governance frameworks, model risk management (SR 11‑7 or equivalent), and emerging AI regulation (EU AI Act).
* Background as a penetration tester, security engineer, or bug bounty participant — hands‑on offensive experience sharpens defensive architecture.
* Relevant certifications: CSSLP, OSCP, OSWE, AWS Security Specialty, AWS Machine Learning Specialty, CCSP, or CISSP.
* Experience with runtime protection tooling: RASP, WAF tuning, or API security gateways (Salt Security, 42Crunch, or similar).
* Familiarity with data residency regulations, multi‑region tenant deployment, and data sovereignty requirements.
* Experience building developer security tooling, secure‑by‑default SDKs, or internal security/AI platforms.
* Contributions to open‑source security or AI safety projects, or public writing on AppSec or AI architecture topics.
What We Offer:
Hybrid working:
At Finova, we believe the best outcomes come from working together - and having the flexibility to work in a way that suits both our people and our business. We operate a hybrid working model, with most teams spending around three days a week in the office and with our customers. This time together helps us stay connected, collaborate more effectively, and solve complex challenges as a team. We also know that flexibility matters. Our approach is designed to support a healthy balance, combining in‑person collaboration with the freedom to work remotely where it makes sense.
Holiday
25 days holiday plus bank holidays, bank holiday trading and holiday purchase options, the opportunity to work from anywhere in the world for up to 4 weeks per year.
Looking After You
Life Assurance, Group Income Protection, Private Medical Insurance, a pension scheme via Salary Exchange, an Employee Assistance Programme, and access to a Virtual GP.
Family‑Friendly Policies
Enhanced maternity and paternity pay, as well as paid time off for fertility treatments and pregnancy loss.
Extra Perks
Cycle to Work Scheme, discounts on shops, restaurants and gym memberships, free fresh fruit daily, and opportunities to join colleague networks and social groups.
Giving Back
One paid volunteering day annually and the Give‑As‑You‑Earn scheme to support your favourite charities.
Equal Opportunity Statement
We value diversity and are committed to creating an inclusive environment for all employees. If you’re passionate about this role but don’t meet all the criteria, please reach out—we’d love to discuss how your skills and experiences align with our needs.
#J-18808-Ljbffr