Experienced Solutions Architect focussing on Cybersecurity and Agentic AI

I worked as a service/domain architect in the IAM space. The domain I am responsible for encompasses
identity providers, SSO solutions, location-aware access control, enterprise vault technologies, PKI
systems, MFA systems, password-less login, management of service accounts, human and application
account credentials, and physical buildings access control. My key contributions in his role are as
follows:

* Lead architect for a regulatory technical security control to address the ownership, lifecycle
management, credential management, and access right management of application service accounts
across the enterprise.
* I lead a cross-divisional bank-wide API security working group of that is responsible producing
patterns and guidance for the adoption of modern authentication (OAuth2/OIDC) with Microsoft
Azure Active Directory, adoption of service mesh technology, and migration from Apigee to Azure
API Management across the enterprise.
* Headed the IAM working group. This was a forum to discuss current and future concerns and align
strategy across application access control, infrastructure access control and access governance.
* Architecture, design, and rollout of a password-less login solution for employees to enable 2FA
access to Citrix workspace desktops. This solution leverages software provided by Transmit
security to replace traditional Windows passwords with a strong mobile app-based 2FA login
experience and was heavily relied upon during the pandemic to support remote working.
* Architecture and design of enterprise service account credential storage strategy leveraging a
mix of Hashicorp vault, CyberArk and Azure key vault.
* Design of enterprise-wide standards to cover the lifecycle, storage, and cryptographic
requirements for the use of tokens in the bank.
* Design of dynamic service account credential strategy, using multiple vendor and in-house
products.
* Architecture of a solution to replace an older employee building access control system with a
more cost-efficient option from Thales.
* Architecture and design of a mobile-app based customer identity assurance as a service offering
to support the onboarding activities of new wealth management customers. This service allows
customers to use their government issued identity documents and an app on their mobile phones to
verify their identity. Solution was based on software from iProov biometric solutions and Regula
forensics.
* Participating in IAM-specific vendor/product evaluation.
* Participating with Microsoft to shape and evaluate new product features built by Microsoft in
Azure to address UBS needs.
* Architecture and design of tools and processes to manage the request, review, and reconciliation
of permissions requested by application teams on Azure AD service principals and managed
identities.
* Creation of patterns to promote adoption of Zero Trust Architecture principles within the bank.
* Creation of patterns to leverage Azure API Management for internal and external microservices.
* Creation of security event logging and monitoring requirements for applications and identity
providers, corelating these requirements with MITRE ATT&CK TTPs,

I worked as a solutions architect with the Security, Authentication & Fraud lab within Lloyds
Banking Group. I have worked on the following:

* Worked with the Payments, Fraud, & Financial Crime theme to design and deliver into production a
solution that allows customers on low-risk payment journeys to self-serve fraud alerts using an
out-of-band authentication mechanism. This involved:
* Building a number of RESTful micro services to build a CIBA (Client Initiated Backchannel
Authentication) compliant OOB auth mechanism in the bank,
* Building a number of integration layer micro services to allow the retail authenticated
payments journeys to integrate with the OOB authentication services
* Modification of the banks retail cross channel transactional fraud detection engine.
* Development of micro services to suspend/cancel/release payments and suspend/reinstate
mandates.
* Capacity planning, infrastructure uplift, application logging, service monitoring.
* Integration with Hortonworks Hadoop-based Big Data platform for service analytics and
Tableaux reporting.

* Worked with the Strong Customer Authentication (SCA/PSD2) team to design and build a primary
customer step-up authenticator mechanism for 128 journeys spanning retail banking, business
banking, open banking, and cards. This is a high-availability Category A service capable of
sustaining 1200 transactions per second.

* Worked with the Mobile security team to build an asymmetric cryptography-based transaction
signing mechanism on the Lloyds, Halifax, and Bank of Scotland mobile app. This involved working
with a third-party supplier as well as creating micro services to manage key exchange, key
storage , key rotation, and digital signature validation.

* Worked with the Mobile security team to build a server-side security product that captures
real-time behavioral, malware, and usage data from the banks mobile apps to make a decision on
whether the device running the app can be trusted at the point a transaction is made.

* Worked with the Big Data Insights team to build a generic data ingestion pipeline from micro
services into Hadoop clusters. This involved using Apache Flume, Kafka, Spark, Hive.

* Worked with third-party security service provider CallSign to integrate their AWS-hosted services
with the banks systems via AWS DirectConnect.

* Architectural governance and Infrastructure solution design for abovementioned items, including
F5 GTM/LTM configuration, Firewall configuration, DNS setup, API gateway onboarding, and MA-TLS
setup.

(Received award for Outstanding Contribution to the Barclays Launchpad platform).

I have worked as a solutions architect on the Barclays Launchpad team. The Launchpad product won the
Banking Technology Innovation award 2016. My day-to-day responsibilities involved:

* E2E (end-to-end) design involving data on mainframes, Ab Initio ETL processes, PaaS service
layers, Internet Facing Environments (IFE), CMS, Mobile gateways, Web servers, Application
Servers, Logging (Splunk), Application Monitoring (AppDynamics) and Databases (Oracle, Mongo).
* Managing relationships with third-party vendors.
* Building solutions to allow third-party vendors to provide Docker containers that will be spun up
on OpenShift V3 pods and connected to other up-stream services.
* Creating solutions to integrate PFM (personal finance management), behavioral and biometric
security technologies provided by third-party vendors.
* Creating strategies to auditing vendor-provided Docker images.
* Providing leadership to bring together business, application, infrastructure and data
requirements into a single set of solutions options and recommendations.
* Providing clear choices and recommendations to stakeholders to facilitate business and technical
decision making.
* Managing key relationships with stakeholders across multiple business units.
* Reviewing use cases and related requirements documents for technical feasibility and logical
consistency.
* Identifying and documenting key architectural decisions in Confluence and ensuring these are
shared and aligned with governance standards.
* Creating High-Level Design (HLD) and Detailed-Design (DD) documents. Securing approval from
different departments within the bank.
* Building and maintaining relationships with individuals from Security, GIS, Data Privacy,
Compliance, ETL, Data, and Fraud teams.
* Ensuring solutions are fit for purpose and strategically aligned as well as meeting relevant
standards and regulatory requirements.
* Liaising with service and configuration management teams to build relevant xPaaS environments,
and integrate relevant monitoring systems with software deployed onto these environments.