Security Architect

We’re On the Beach! Since 2003, we've been rewriting the rules of how people discover, book, and experience their perfect getaway. What started as connecting people to short-haul beach holidays has evolved into something much bigger - premium beach destinations, long-haul adventures, and vibrant city breaks – and that’s just the beginning of our story.

We send around two million holidaymakers on their dream breaks every year. And we're still growing.

Powered by our deep-rooted entrepreneurial spirit, proprietary tech, curiosity and our incredible people, we’re accelerating - delivering best in class technology, the ultimate holiday app, and experiences that keep our customers coming back for more.

Ready to build the future of travel with us?

About the Role

At On the Beach, we help millions of customers discover, plan and book their beach holidays. We’re looking for a hands-on Security Architect to help secure the systems behind those journeys.

There’s a substantial job to do across our AWS and GCP environment. You’ll need to understand what we have, identify where improvements matter most and agree priorities with engineering and security colleagues. Some changes will take time. Others will need practical fixes to the systems we run today.

You’ll lead security design and help teams put it into practice. That means getting into code and configuration, testing assumptions and staying involved through delivery. We’ll judge the work by whether the changes are adopted and address the problem.

You’ll report to the Head of Architecture, who reports to the VP of Engineering. You’ll work alongside Architects, Principal Engineers and Staff Engineers, and with security leadership to connect technical decisions to business priorities and risk.

This is a Principal individual contributor role. You’ll influence decisions, help other engineers develop and take responsibility for seeing agreed work through to completion.

What you’ll be doing day to day

We’re focused on improving our Security Posture across our entire estate. What you’ll do:

• Protect customer accounts, bookings and payments - Help teams secure the services our customers use and the connections we make to suppliers. Consider how those services could be attacked or misused.

• Lead security design decisions - Set out the options, explain the consequences and make a recommendation. Record important decisions and give teams guidance they can use.

• Translate, explain, and prioritise - Work with the business and engineering teams to make sure that business understands the security work that needs to be done, and engineering’s prioritisation matches the business needs.

• Improve cloud and identity security - Work with the Cloud team on access permissions, service identities, account and project structure, networking and logging across AWS and GCP.

• Make secure approaches easier to use. Work with Development and DevEx teams to build reusable designs, infrastructure modules and automated checks that fit how teams develop and deploy software.

• Lead threat modelling - Help teams identify what could go wrong, understand the impact and agree what needs to change. Follow up on actions and make any remaining risks clear to the people responsible for accepting them.

• Protect sensitive data - Help establish what data we hold, where it moves and who can access it. Design appropriate controls for access, encryption, secrets, retention and deletion.

• Support detection and incident response - Work with SecOps and Infrastructure teams on logging and the capabilities needed to investigate, contain and recover from incidents. Feed what we learn back into our designs.

• Advise the Workplace team. Help with security architecture for employee access, laptops and mobile devices, working with the teams that manage those services.
  

You’ll be a great addition to our team if you have the following skills, knowledge and experience

You’ll have a strong mix of technical skills and key behaviours needed in a busy, fast-moving technical environment that embraces change. You’ll report to the Head of Architecture, who reports to the VP of Engineering. You’ll work alongside other Architects, Principal Engineers, and Staff Engineers.

Technical skills we’re looking for

• Cloud and containers - You have strong practical experience securing AWS or GCP environments, including access controls, networking and account or project structure. You understand Kubernetes security and can work across both cloud platforms. You don’t need equal depth in both.

• Hands-on engineering - You use code and configuration to understand how systems work. You can review application code, test a design and make targeted changes alongside developers. Our languages include C#, TypeScript, Python, Ruby and Rust. Experience with comparable languages is welcome.

• Security architecture - You’ve made security design decisions and helped get them implemented. You can explain why you chose an approach, the constraints you worked within and whether it delivered the intended result.

• Identity and application security - You understand authentication, authorisation, API security and OAuth 2.0/OIDC. You can assess how customers, employees and services get access, how services trust each other and how application behaviour can create security weaknesses.

• Security in development and deployment - You’ve used Terraform or similar tools and automated checks to improve security. You understand the risks around dependencies, build and deployment processes, and the credentials they use.

• Threat modelling - You’ve helped teams identify realistic threats and decide what to address first. You can explain which changes are needed before release, which can be planned and what risks remain.

Useful experience

We’d also welcome experience in any of these areas:

• Customer accounts, online transactions, payments or supplier integrations.

• Account takeover, malicious bots or transaction fraud.

• Working with privacy and compliance colleagues to turn GDPR, PCI DSS or ISO27001 requirements into technical controls.

You don’t need to cover every item. We’re interested in the decisions you’ve made, the improvements you’ve delivered and how you worked with others to get there.

You may already be a Security Architect, or a senior Security Engineer doing this kind of design work. The experience matters more than your current title.

How you work

You understand the business context - You consider customer impact, cost, operational needs and delivery pressures. You explain the consequences of different options and take decisions that need business approval to the right owner.

You work well with engineers - You get involved early, listen to constraints and help teams find an approach they can deliver. You can challenge a decision clearly and constructively.

You help others improve - You share knowledge, review work and help engineers become more confident in making security decisions.

You follow through - You help turn recommendations into agreed work and check that the changes address the original problem.

You’ll take your turn on our on-call rota - As part of our security and architecture community, and help deal with the rare incident. We run on-call sustainably, with a strong emphasis on reducing page outs by fixing root causes, blameless post-incident reviews, and fixing noisy alerts.

What to expect from our interview process

After a call with our Talent team, we will run a 3 stage interview process all on Google Meets.

1st - Initial Hiring Manager call with our Head of Architecture
2nd - Technical round which will include a system design round with our Lead Architect
3rd - Behavoual interview with a cross function panel.

We want to make sure everybody has the opportunity to perform at their best. If you require any reasonable adjustments during the interview process please let the Talent Acquisition team know and they will be happy to assist.

Ways of working
Our full time hours are 37.5 per week, but we don't have rigid working hours so you can find the working pattern that's right for you. We have core working hours between 10am - 4pm, so we can collaborate and enjoy the social side of work.

We also have remote 1st ( UK Based ) working so we all work from home and from our Aeroworks office in Manchester City Centre when required to meet with our teams and collaborate on a adhoc basis.

Our benefits
We might be biased but we think our colleagues are pretty great. They're the people that have made On the Beach what it is today and continue to make it vibrant and successful tomorrow. That's why we offer a competitive benefits package, known as our Beach Perks, to all On the Beach colleagues.

These include:

• 25 days holiday plus your birthday off

• Generous discount on holidays, plus you will receive 2 extra days annual leave on top of your holiday allowance to use whilst you're away on your On the Beach package holiday

• Access to Learnerbly learning platform, plus workshops, courses and professional qualifications

• Enhanced maternity, paternity, shared parental leave and adoption pay, plus other family friendly support

• Employee Assistance Programme and free access to counselling

• Simplyhealth Optimise Health Plan

• Company Sick Pay scheme

• Regular wellbeing events

• Gym discount

• Share Incentive Plan (SIP)

• Death in Service cover

• Onsite subsidised coffee shop

• The Sandbox (our very own bar)

• Food and drink discounts across a number of venues in Manchester City Centre

• Regular social events

• Cycle to Work scheme