Information Security Architect

Information Security Architect – Information Security

Office first

Team description

SumUp's Information Security team protects a payments platform used by millions of small businesses, which means the work here directly shapes whether merchants can trust us with their money every single day. As an Information Security Architect, you'll help decide how security gets built into new products from day one, from mobile payments to the secure use of AI, while also stepping in as a senior responder when things go wrong. It's a role that sits at the intersection of prevention and response: you'll shape the architecture that stops incidents from happening, and you'll be in the room leading the response when they do anyway.

What you'll do

Define security architecture requirements for high-risk initiatives, including PCI PIN, payment processing, and mobile payment surfaces

Build automation for security architecture assurance and incident response, such as policy-as-code, detection-as-code, and SOAR workflows

Lead incident triage, investigation, containment, and remediation for complex, high-severity security incidents

Develop and improve incident response playbooks and detection automation with the wider security team

Coordinate with Engineering, Platform, IT, Product, Risk, and Compliance to validate security before launch

Maintain a prioritised security roadmap that balances architecture work with lessons learned from incidents

You'll be great for this role if…

More than 8 years of security experience, typically including at least three years focused on security architecture and substantial hands-on incident response

Strong knowledge of SIEM/SOAR/CNAPP systems

Experience working with modern Cloud vendors (AWS/AZURE/GCP) & SaaS solutions (Vercel, n8n, Cloudflare, Langdock, Cursor, IncidentIO, Notion, Vanta)

Strong knowledge of payment security standards, including PCI DSS and PCI PIN

Experience building or improving detection as code, security automation pipel