Senior Lead Cybersecurity Architect

About the role

Dymon Asia Capital is building its Cybersecurity function across four pillars; this role owns the Architecture and Engineering pillar and acts as the firm's formal security design authority. It sets the target security architecture and standards that infrastructure, cloud, trading and application changes are built against, and takes those designs through build to operation. The environment is Microsoft-centric with Azure as the only public cloud, and the role is about 60% hands-on engineering and 40% architecture and design, with secure adoption of LLMs and AI agents a key priority.

Key responsibilities

• Own the architecture and engineering pillar, including the target security architecture, reference designs and roadmap, aligned to the cybersecurity strategy set by the Head of Cybersecurity.
• Act as security design authority, giving sign-off on material infrastructure, cloud, trading, application, AI and vendor changes, setting engineering guardrails and documenting deviations from standard.
• Own the security architecture for LLM and AI agent adoption, including Microsoft Copilot and agent platforms, identity, least privilege, prompt injection and data leakage controls, Purview governance of AI interactions and logging for Security Operations.
• Secure the trading environment (order and execution management systems, FIX and broker connectivity, co-location, market data) with controls that respect latency and availability.
• Design Entra ID identity and access architecture, including conditional access, Privileged Identity Management, service and workload identities, secrets management and a Zero Trust foundation.
• Design secure Azure landing zones, SonicWall perimeter and network segmentation, and Intune and Defender hardening baselines using Azure Policy and infrastructure as code.
• Architect data protection for trading strategies, research data, model code and investor information using Purview, encryption, key management and ransomware-resistant backup and recovery.
• Secure the engineering and research environment (source code repos, CI/CD pipelines, quantitative research platforms) and run threat modelling for new platforms, AI use cases, SaaS adoption and key third parties.
• Lead technical delivery of major security initiatives with the Cybersecurity Project Manager, and turn penetration test, red team, audit and risk register findings into engineered fixes.
• Maintain architecture evidence and control mapping aligned to MAS Technology Risk Management guidelines, applicable MAS notices and NIST CSF 2.0, and present architecture decisions and risk trade-offs to technology leadership.

Required profile

• Degree in Computer Science, Information Security or a related discipline preferred.
• 10+ years in cybersecurity engineering and architecture, including 4+ years as a lead security architect or design authority in financial services, ideally at a hedge fund, asset manager or investment bank.
• Proven track record of designing and delivering security architecture in a hybrid Microsoft and Azure environment, through to operational handover.
• Experience securing trading environments (OMS, FIX, co-location, market data) with an understanding of latency and availability constraints.
• Practical experience securing LLM and AI agent adoption, with working knowledge of the OWASP Top 10 for LLM Applications and the NIST AI RMF.
• Sound judgement in right-sizing security, able to explain trade-offs to engineers and senior stakeholders.

Required skills

• Certifications such as SC-100, AZ-500, SC-300, CISSP, CCSP or SABSA are advantageous.
• Entra ID, conditional access, PIM, Intune, Defender XDR, Defender for Cloud, Purview and Azure security architecture, with practical Zero Trust design experience.
• Network security architecture, including next-generation firewalls, segmentation and secure remote access; SonicWall experience is advantageous.
• Infrastructure as code with Terraform or Bicep, and scripting in PowerShell or Python; KQL is advantageous.
• Threat modelling using STRIDE or MITRE ATT&CK, and working knowledge of MAS Technology Risk Management guidelines and NIST CSF 2.0.