AWS Principal Systems & Security Architect

Job DescriptionJob Title: AWS Principal Systems & Security ArchitectReq ID: 61303Job Function: EngineeringPosting Start Date: 31/07/2026Posting End Date: 16/08/2026Division: NetworksJob Location: GBR Bristol - Assembly, GBR-London-BTHQ One BrahamAdvertised Salary: Competitive with great benefits Recruiter: Luke Byrne Hiring Manager: Girish Mahanjan Career Grade: CLC Internal Closing Date: 16th August 2026 Locations: London or Bristol About the role This role sits at the intersection of AWS system design and security within BT's Mobile Data-Driven Operations (DDOps) division. Half the role is dedicated to architecting scalable, resilient, distributed AWS systems that power real-time telecom network analytics and AIOps automation - anomaly detection, predictive maintenance, and automated incident remediation. The other half is dedicated to embedding security-by-design across those same systems: protecting sensitive network telemetry and customer data, enforcing least-privilege access, and ensuring compliance with telecom and data-protection regulation & telecommunications security act. The successful candidate balances architectural trade-offs between performance, cost, and risk, and acts as the technical authority ensuring that system design nor security is addressed equally. What you'll be doing What you'll be doing - your accountabilities -System Design • Architect Distributed AWS Systems: Design scalable, event-driven architectures (SQS, MSK, Lambda, EKS/ECS/EMR, Step Functions) supporting AIOps telemetry ingestion, correlation, and automated remediation across the mobile network estate. • Define Reference Architectures: Set standards for streaming, lakehouse, and microservices patterns handling high-volume mobile network and customer usage data. • Architect Scalable Data Solutions: Design and implement enterprise-grade data pipelines and architectures using AWS services (e.g. S3, Glue, Lambda, Redshift, EMR, Kinesis,ClickHouse), optimised for analytics and scalability. • Design for Resilience: Own multi-AZ/multi-region strategy, disaster recovery, and chaos-engineering practices for mission-critical AIOps platforms. • Enable AIOps & MLOps: Partner with data science and MLOps teams to embed anomaly detection and predictive-maintenance models into production system design. • Own Non-Functional Requirements: Balance latency, throughput, availability, and cost across the platform and manage the complete data lifecycle-from capturing learning interaction data to delivering consolidated insights-ensuring data is accurate, accessible, and actionable.What you'll be doing - your accountabilities -Security Architect • Own Security Architecture: Design IAM, KMS, network segmentation, and VPC architecture across all AWS workloads. • Champion DevSecOps: Embed security scanning, IaC checks, and secrets management into CI/CD pipelines. • Lead Threat Modelling: Run architecture-level security reviews, threat modelling, and remediation of penetration-test findings. • Ensure Regulatory Compliance: Uphold GDPR, UK Data Protection Act, Ofcom, and internal BT security policy requirements across the platform. • Own Detection & Response Architecture: Design logging, monitoring, and automated remediation using CloudTrail, GuardDuty, and Security Hub. Essential Skills / Experience Systems Design skills you'll need to succeed• Extensive AWS System Design & Security Experience: Demonstrated 4+ years of experience in designing complex data pipelines deployed in AWS, with deep knowledge of all foundational AWS services and major data analytics services. Demonstrated 3+ years of Security experience in AWS handling complex implementations • Distributed Systems Expertise: Proven experience designing distributed, event-driven systems on AWS at scale. • Streaming & Lakehouse Architectures: Hands-on experience with Kinesis/MSK, EKS/ECS/Fargate, Lambda, and Step Functions. • AIOps & Observability Tooling: Familiarity with CloudWatch, OpenSearch, Grafana, and SageMaker for real-time analytics and anomaly detection. • Performance & Cost Trade-offs: Track record of optimising systems for reliability, latency, and cost.Security skills you'll need to succeed • AWS Security Services: Deep expertise in IAM, KMS, GuardDuty, Security Hub, Macie, WAF, and Shield. • Compliance Frameworks: Working knowledge of GDPR, ISO 27001, NIST, and Ofcom telecom regulatory requirements & TSA. • DevSecOps: Experience with IaC security scanning (e.g. Checkov, tfsec) and secrets management (Secrets Manager, Vault). • Certifications (desirable): AWS Security Specialty, CISSP, or CCSP. • Communication: Ability to explain security and architectural trade-offs clearly to both technical and non-technical stakeholders. Our Package • 15% on target bonus • Company car or £5,500 cash alternative • Private healthcare for self and family • BT Pension scheme, minimum 5% Employee contribution, BT contribution 10% • From January 2025, equal family leave: receive 18 weeks at full pay, 8 weeks at half pay and 26 weeks at the statutory rate. It's for all parents, no matter how your family is made up. • 25 days annual leave (not including bank holidays), increasing with service • Huge range of flexible benefits including cycle to work, healthcare, season ticket loan • World-class training and development opportunities • Option to join BT Shares Saving schemes. • Discounted broadband, mobile and TV packages • Access to 100's of retail discounts including the BT shop