Big Bank Funding. FinTech Thinking.

HSBC’s technology teams collaborate with global businesses and infrastructure functions to design, build and run digital services that allow millions of customers worldwide to bank quickly, simply and securely. We run and manage an enormous technology estate, including data centres and banking systems.

Head of Infrastructure Security

We are looking for a Head of Infrastructure Security to shape our long‑term strategy and turbo‑charge delivery as the accountable owner for Infrastructure Security across the bank. This role ensures secure configuration and protection of operating systems (Unix/Linux, IBMz/i), databases (Oracle, SQL Server, MongoDB), cloud assets (containers), middleware (WebSphere, MQ), virtualization technology (ESX), network fabric (F5s, switches) and end‑user devices (ATMs, VDI, mobile).

Responsibilities

• Strategy: Define and maintain our global strategy for Infrastructure and Endpoint Security, supported by engineers, platform owners, architects and multiple control owners, enabling business success, meeting regulatory expectation and industry-benchmarked best practice, whilst responding to current and likely threat actor evolution. Includes: security standards as code; continuous platform security assessments, security agent optimisation, and risk-based capability expansion and maturity uplift.
• Delivery: Own the investment roadmap for Infrastructure and Endpoint Security and its successful delivery across multiple partners. Enable multiple cyber mandates to be enforced by default. Ensure the transparent prioritisation of a common backlog to drive risk reduction, simplification and address wider strategic needs. Influence, challenge and steer delivery within partner teams across Technology (e.g. Distributed Compute).
• Innovation: Empower HSBC to successfully navigate cyber risk with innovative, responsive and frictionless technologies and services, both those delivered in-house and from external partners. Foster and empower a culture of innovation, experimentation, and continuous improvement. Near‑term focus on platformification.
• Partnership: Form close partnerships with engineering teams: as design partners – for how capabilities will be implemented and operated, at times in novel ways; as customers – understanding their needs as they consume secure baselines or operationalise new platforms, and as delivery partners – prioritising change within Cybersecurity Engineering teams, and to drive bank‑wide adoption of uplifts.
• Services: define, operate and mature secure baseline maintenance and security consulting to platform and infrastructure owners across the bank. Support / implement security changes on certain core platforms. Analysis of signal and event data from endpoint security capabilities, driving continual optimisation and end‑to‑end efficacy against threat activity. Provide security consulting, especially early‑on in the design journey.
• Oversight: Ensure Infrastructure and Endpoint Security is robustly managed, end‑to‑end, throughout the organisation: from platform acquisition, service deployment through to federated operation. Drive a data‑centric approach to observability and assessment, supported by automation, measurement and analytics.
• Accountability: Ensure regulatory and risk management outcomes are being maintained or robustly managed. Ownership of High‑Risk Audit, Regulator and self‑identified issues. Ownership of the capability budget, balancing run and change investment. As a senior leader, contribute to and champion change across both Cybersecurity and Technology, occasionally outside of your primary remit.
• Talent: Lead, manage, invest in, recruit and inspire a team of highly skilled and performing SMEs across the globe. A culture driven by empowerment, experimentation, learning, partnership and delivery. A place where colleagues thrive, solving meaningful problems that keep the bank and its customers safe.

Qualifications

• Proven experience in technology leadership roles, running high performing technology teams.
• Robust understanding of common industry cyber security frameworks, standards, and methodologies, such as CIS and NIST.
• Strong data‑driven analytical skills and experience identifying and resolving complex problems.
• Expert knowledge in infrastructure and/or protective security.
• Managing, developing and retaining high‑performing individuals in different geographies, often remotely.
• Experience within fast‑moving, complex and demanding corporate environments and able to provide appropriate direction to the team whilst dealing with ambiguity and change.
• Ability to engage with and influence senior peers and leadership.
• Proven ability to collaborate across different sectors to solve complex problems.
• Strong experience executing risk and control management frameworks, preferably from a multi‑market institution.
• Ability to articulate technical threats, scenarios, controls and risks to both technical and business stakeholders.

Location

This role is based in Sheffield or Birmingham.

EEO Statement & Contact

At HSBC, we’re dedicated to creating diverse and inclusive workplaces—anyone’s gender, ethnicity, disability, religion, sexual orientation, or age. We are committed to removing barriers and ensuring careers at HSBC are inclusive and accessible for everyone to be at their best. We take pride in being a Disability Confident Leader and will offer an interview to people with disabilities, long‑term conditions or neurodivergent candidates who meet the minimum criteria for the role. If you have a need that requires accommodations or changes during the recruitment process, please get in touch with our Recruitment Helpdesk.

Email: hsbc.recruitment@hsbc.com
Telephone: +44 207 832 8500