Application Security Architect

About the role

Capital.com builds and operates web and mobile trading platforms, public and partner APIs, and the backend services behind them, all in a highly regulated environment. As Application Security Architect, you will be the senior design authority for the security of these products. You will set the direction for how we secure software at scale: you will own secure-by-design patterns and standards, lead threat modelling and architecture reviews, and define the application security baseline that engineering teams build against.

Working closely with the Product Security team and the Director of Product Security, you will guide AppSec processes and set the vision for your area without direct line management. You will treat security as a shared outcome rather than a gate, balancing strong protection with developer experience and delivery speed, and you will earn adoption through enablement rather than mandates.

Responsibilities: Security Architecture & Standards:

- Define and maintain secure-by-default reference architectures for common patterns: web apps, mobile backends, microservices, public and partner APIs, and event-driven services

- Own core application security architecture decisions: authentication and authorisation, session management, API security, secrets management, multi-tenant isolation, and security logging and auditing

- Lead the redesign of user authentication and the delivery of security features into the product

- Develop and roll out application security standards, secure-coding guidelines, configuration standards, reusable design patterns, and architecture decision records (ADRs) that engineers can apply without a security expert in the room

- Define internal policies for the safe use of AI-assisted and vibe-coding tools

- Define security requirements for acquired technology and guide its secure integration

Threat Modelling & Design Review:

- Establish and run a threat-modelling operating model, covering scope, cadence, templates, and facilitation, proportionate to each product's risk tier

- Own the security review stage of the new product approval process, covering architecture design and configuration

- Lead design reviews for high-impact initiatives: new products, new auth flows, payment and sensitive-data flows, platform migrations, and major refactors

- Identify design-level risks and agree practical, prioritised mitigations with engineering teams

Secure SDLC, DevSecOps & Supply Chain:

- Assess the current state of application security, propose improvements, and drive the secure SDLC strategy with Engineering and Security leadership

- Oversee AppSec processes and own the tooling strategy (SAST, DAST, IAST, SCA, and secrets scanning), including how findings flow back to engineering

- Embed security controls as guardrails in CI/CD through policy-as-code, with agreed enforcement and escalation paths