Cyber Security Architect

About the Role

The WAAP Platform Engineer provides engineering leadership for HSBC’s Web Application and API Protection (WAAP) capability across multiple platforms and thousands of applications. This role translates capability strategy and cyber architecture into actionable engineering artefacts, platform standards, reusable templates, guardrails, and implementation guidance. Working closely with Cyber Architecture, the WAAP Capability Owner, Engineering, and Operations, the role ensures platform designs and controls are robust, scalable, supportable, and aligned with HSBC security and compliance requirements. It also evaluates non-standard business requirements, provides product-focused technical guidance, and ensures deviations are appropriately risk-assessed and documented. The successful candidate will combine strong WAAP engineering expertise with effective stakeholder leadership. They will drive continuous improvement, discovery, and efficacy testing; connect capability and architecture intent with platform delivery; and establish structured feedback loops so that operational lessons, engineering challenges, and improvement opportunities are captured and acted upon.

Key Responsibilities

• Engineering leadership for the WAAP capability: Act as a primary engineering lead, setting technical direction and promoting consistent engineering practices across the capability.
• Collaborate with Cyber Architecture and the WAAP Capability Owner to translate strategy, target-state architecture, control requirements, and product priorities into actionable engineering artefacts and delivery plans.
• Platform standards, templates, and guardrails: Partner with Operations to define and maintain platform standards, reference patterns, reusable engineering templates, configuration baselines, and guardrails for the seven Cyber-supported WAAP solutions.
• Ensure engineering artefacts are secure, robust, scalable, automatable, supportable, and aligned with HSBC security, risk, and compliance requirements.
• Business engagement for non-standard solutions: Engage business and technology stakeholders to assess requirements that fall outside approved patterns or standard platform capabilities.
• Provide technical options and product guidance, challenge unnecessary variation, and ensure approved deviations are risk-assessed, documented, governed, and traceable.
• Continuous improvement, discovery, and efficacy testing: Identify opportunities for new or enhanced WAAP functions, controls, automation, and operating practices.
• Lead technical discovery, proofs of concept, and efficacy testing for platform capabilities, managed and custom controls, and emerging protection requirements.
• Drive innovation, engineering quality, and delivery efficiency while keeping pace with evolving cyber threats, technology changes, and business needs.
• Feedback loops across capability, architecture, platform, and operations: Provide structured feedback to Capability and Architecture teams so lessons learned, control gaps, and improvement opportunities inform roadmaps and design decisions.
• Work with Engineering and Operations teams to understand delivery and support challenges, prioritize improvements, and provide clear product and engineering leadership through implementation and lifecycle management.

Key Accountabilities

• Own the quality, consistency, and technical integrity of engineering outputs for the WAAP capability.
• Produce and maintain engineering standards, reference designs, patterns, configuration baselines, decision records, and implementation guidance.
• Ensure requirements and architecture decisions are translated into deliverable, testable, and operationally sustainable solutions.
• Define acceptance criteria and evidence for platform controls, including functional, security, resilience, performance, and efficacy outcomes.
• Promote automation and repeatability through infrastructure-as-code, policy-as-code, APIs, and CI/CD integration where appropriate.
• Assess non-standard designs and exceptions, documenting technical rationale, risks, compensating controls, ownership, and remediation or exit plans.
• Coordinate technical discovery and evaluation of new WAAP capabilities, product features, and vendor solutions.
• Use operational telemetry, incidents, tuning outcomes, engineering feedback, and threat intelligence to identify and prioritize platform improvements.
• Facilitate design reviews and technical forums, communicating decisions and trade-offs clearly to technical and non-technical stakeholders.
• Support the WAAP roadmap by identifying dependencies, technical debt, lifecycle risks, and opportunities to simplify or consolidate the platform estate.

Requirements & Tech Stack

• Demonstrable experience engineering enterprise WAAP, WAF, API security, bot management, DDoS protection, or related application-edge security platforms.
• Experience providing technical leadership across complex, multi-platform environments and translating strategy and architecture into implementable engineering outcomes.
• Strong understanding of web and API protocols, modern application architectures, common attack techniques, and layered mitigation strategies.
• Practical experience defining platform standards, reusable patterns, configuration baselines, guardrails, and technical documentation.
• Experience with several major WAAP or WAF technologies, such as AWS, Google Cloud, Azure, Akamai, F5, Cloudflare, and an understanding of their deployment and operating models.
• Knowledge of cloud, network, application delivery, identity, observability, resilience, and DevSecOps principles relevant to WAAP services.
• Experience with automation, APIs, infrastructure-as-code, policy-as-code, source control, and CI/CD pipelines.
• Ability to design and execute proofs of concept, control validation, and efficacy testing, and to turn results into clear engineering recommendations.
• Sound risk judgement with experience assessing exceptions, documenting technical decisions, and working within security, compliance, and governance frameworks.
• Strong analytical and problem-solving skills, with the ability to balance security outcomes, business needs, operability, cost, and delivery constraints.
• Excellent written and verbal communication skills, including the ability to influence architecture, capability, engineering, operations, and business stakeholders.
• A collaborative, outcome-focused approach and a commitment to continuous learning, service improvement, and engineering excellence.