Security Architect

What you'll do

What you bring

• 12+ years across security architecture, cloud infrastructure, and enterprise IT.
• You've made architecture decisions that held up as companies grew, and you know what breaks first at scale.
• You've recently built and run something other people depend on, by directing agents or otherwise: a product, a platform, or an internal tool. This role ships; it is not an oversight role.
• You build with AI agents as your primary engineering tool. You specify the work, review what agents produce, and can tell code that runs from code that is secure and will hold up in production, across Python, Go, TypeScript, and Terraform.
• You've shipped LLM or agent systems to production that people rely on. You can explain how you evaluated them, how they failed, and the controls they needed: tool and MCP governance, retrieval with access controls, approval steps, and cost limits.
• You tie security work to product and business outcomes. You can explain the tradeoffs to an executive and hold your own in design reviews with senior engineers.
• Deep AWS experience: multi-account organizations, identity, network security, and infrastructure as code.
• Zero Trust and identity architecture in practice, for both workforce and services: SSO, user provisioning, device management, and privileged access.
• Product security depth: threat modeling, secure design review, supply-chain security, and SDLC automation with code scanning, dependency analysis, and secret detection.
• You default to delivering everything as code: infrastructure, policy, detections, and controls.
• You think in platforms. You'd rather give every team a secure way to build than build everything yourself, and you know what makes a platform people adopt by choice.
• You can work with a sales or customer success lead, find the real problem behind the request, and deliver a workflow they keep using.

Nice to have

• Security architecture for a SaaS product.
• A regulated or high-trust background, or experience with compliance programs such as SOC 2 or ISO 27001.
• Multi-tenant SaaS security, including tenant isolation.
• Experience building detections and monitoring for the systems you own.
• Experience with a second cloud provider.
• How we work
• Small team. What you build runs in production and changes how Sales, Customer Success, and Finance work.
• Work ships behind alerting and runbooks, and the people who build it share on-call.

How we work

About NetBox Labs:

Our culture and values:

Qualifications

• 12+ years across security architecture, cloud infrastructure, and enterprise IT.
• You've made architecture decisions that held up as companies grew, and you know what breaks first at scale.
• You've recently built and run something other people depend on, by directing agents or otherwise: a product, a platform, or an internal tool. This role ships; it is not an oversight role.
• You build with AI agents as your primary engineering tool. You specify the work, review what agents produce, and can tell code that runs from code that is secure and will hold up in production, across Python, Go, TypeScript, and Terraform.
• You've shipped LLM or agent systems to production that people rely on. You can explain how you evaluated them, how they failed, and the controls they needed: tool and MCP governance, retrieval with access controls, approval steps, and cost limits.
• You tie security work to product and business outcomes. You can explain the tradeoffs to an executive and hold your own in design reviews with senior engineers.
• Deep AWS experience: multi-account organizations, identity, network security, and infrastructure as code.
• Zero Trust and identity architecture in practice, for both workforce and services: SSO, user provisioning, device management, and privileged access.
• Product security depth: threat modeling, secure design review, supply-chain security, and SDLC automation with code scanning, dependency analysis, and secret detection.
• You default to delivering everything as code: infrastructure, policy, detections, and controls.
• You think in platforms. You'd rather give every team a secure way to build than build everything yourself, and you know what makes a platform people adopt by choice.
• You can work with a sales or customer success lead, find the real problem behind the request, and deliver a workflow they keep using.

Responsibilities

• Build and run the platforms that let teams across the company build their own automations, agent workflows, and software on a secure path by default, with the guardrails built in: pre-approved tools and connectors, scoped identities and credentials, authorization on data retrieval, approval for consequential actions, audit logging, and cost limits.
• Lead enablement so teams can self-serve: templates, starter kits, and reference patterns that make the secure way the fastest way to build, plus the guidance and support to use them well.
• Work alongside teams outside Engineering on their first workflows, then turn what you build into patterns others pick up without you.
• Set evaluation criteria and quality gates for agent workflows built on the platform, covering accuracy, safe use of tools and data, and how they handle failure.
• Build security into the SDLC and PDLC: threat modeling, secure design review, code scanning, secret detection, and supply-chain and CI/CD controls enforced in the pipeline.
• Automate product and cloud security reviews so coverage keeps pace with delivery.
• Automate vulnerability intake, prioritization, routing, and SLA escalation so the team works the highest-risk findings first.
• Build access automation as code, with just-in-time elevation for privileged access.
• Set multi-account AWS guardrails and reference architectures for identity, network, and data.
• Own the services you build end to end: CI/CD, deployment, monitoring, alerting, runbooks, and incident response. You'll join the Security & IT on-call rotation once the systems you own alert on failure. Internal platforms are supported during business hours.