Platform Security Architect

Platform Security Architect

Deel is hiring a Platform Security Architect to own security architecture across its applications, services, and cloud environments, with a primary focus on AWS. You will set the secure design patterns and guardrails that teams build against by default, run Wiz and Aikido as one program that connects code and cloud findings, and lead threat modeling and platform incident response. You will be the technical authority on platform security, working with engineering and leadership as Deel scales, including the AI features it ships.

Responsibilities:

• Own the platform security architecture strategy across Deel's applications, services, and cloud environments, with a primary focus on AWS.
• Define secure design patterns, reference architectures, guardrails, and baseline configurations that teams build against by default.
• Run Deel's security tooling as one program. Operate and tune Wiz for cloud posture (CSPM) and runtime visibility, and Aikido for SAST, SCA, secrets detection, container, IaC, and DAST scanning.
• Connect findings across code and cloud so the team fixes what is actually exploitable, not what is merely noisy.
• Design identity and access at every layer. Own least-privilege cloud IAM (cross-account roles, permission boundaries, SCPs, just-in-time access) and application authentication and authorization (session and token handling, multi-tenant isolation, object-level access control).
• Embed security into the SDLC and CI/CD pipelines. Build the guardrails for application code and Infrastructure as Code alike, with a clear model for what blocks a build and what warns.
• Secure containers and Kubernetes. Set the standards for image hardening and signing, admission control, pod security, network policies, secrets management, and runtime protection.
• Own software supply chain security. Cover dependency and transitive risk, malicious package detection, SBOMs, build integrity, and artifact provenance, from the first npm install to the running workload.
• Lead threat modeling for new and existing systems, and make it part of how engineering designs software rather than a security-team ritual.
• Run vulnerability management for findings from scanners, pentests, and bug bounty: triage, exploitability assessment, SLAs, remediation partnership with engineering, and reporting on risk reduction over time.
• Lead platform security incident response across application and cloud layers: triage, containment, forensics, root cause analysis, and post-incident hardening.
• Partner with Privacy/Compliance so platform controls satisfy SOC 2 Type II, ISO 27001, PCI DSS, and GDPR, and design decisions stay defensible and auditable.
• Scale security through people. Build a Security Champions program and secure coding enablement so security knowledge spreads across engineering instead of pooling in the security team.
• Act as the technical authority on platform security, reviewing high-risk designs, evaluating vendors, and influencing engineering and cloud strategy at the leadership level.
• Use Artificial Intelligence as an enabler to find new insights, learn from past mistakes, and continuously improve Deel's security posture, including securing the AI features Deel ships.

Qualifications:

• 3+ years of hands-on experience in cybersecurity, with real depth in both cloud security and application security engineering or architecture.
• Deep AWS security expertise: IAM design, network controls, logging and monitoring (CloudTrail, Security Hub, GuardDuty), and data protection.
• Deep application security expertise: OWASP Top 10 and API Security Top 10, authentication and authorization design, injection and deserialization, SSRF, business logic flaws, and secure session handling.
• Proven hands-on experience operating security platforms such as Wiz (or Orca, Prisma Cloud) and Aikido (or Snyk, Semgrep, GitHub Advanced Security), including rollout, tuning, false-positive reduction, and integration with engineering workflows.
• Strong experience building security gates into CI/CD pipelines for both application code and Infrastructure as Code.
• Strong experience securing containers and Kubernetes: image hardening, runtime security, pod security standards, and Kubernetes RBAC.
• Hands-on threat modeling experience (STRIDE, attack trees, or equivalent) applied to real systems, with findings turned into concrete engineering work.
• Ability to read, reason about, and write production code in at least one modern language (TypeScript/Node.js, Python, Go, or Java).
• Experience with secrets management (HashiCorp Vault, AWS Secrets Manager) and encryption patterns for data at rest and in transit.
• Experience running vulnerability management or a bug bounty/pentest program, and driving remediation across teams you don't manage.
• Strong working knowledge of SOC 2 Type II, ISO 27001, PCI DSS, and GDPR.
• Ability to turn complex security concepts into clear guidance for engineers and risk-based recommendations for executives.
• Excellent English, written and verbal.

Good to have:

• Background in software engineering, DevSecOps, or platform engineering before moving into security.
• Credibility with engineers and the ability to ship fixes, not just file tickets.
• Offensive security background (web/API or cloud penetration testing, exploit development, CTFs) used to inform defensive design.
• Experience securing multi-tenant SaaS at scale, including tenant isolation and EU data residency requirements.
• Experience securing AI/LLM-powered features (prompt injection, agent and tool abuse, data leakage) or applying AI to security workflows such as triage and automated remediation.
• Multi-cloud experience (GCP or Azure alongside AWS).
• Familiarity with eBPF-based runtime tooling (Wiz, Cilium, Falco, or similar).
• Experience building a Security Champions program or secure coding curriculum.
• Experience in high-growth fintech or global HR technology with complex regulatory requirements.
• Open-source contributions, CVE credits, published research, or conference talks (OWASP Global AppSec, fwd:cloudsec, re:Inforce, BSides, Black Hat, DEF CON).
• Relevant certifications: AWS Certified Security Specialty, OSWE, OSCP, GWAPT, CSSLP, CCSP, or CISSP.

Total Rewards:

Our workforce deserves fair and competitive pay that meets them where they are. With scalable benefits, rewards, and perks, our total rewards programs reflect our commitment to inclusivity and access for all. Our salary range reflects gross base salary. For commercial roles with commission eligibility, this figure represents On-Target Earnings (OTE), inclusive of base salary and target commission. Salary ranges are quoted in USD as a consistent global reference. Final pay is based on objective, job-related criteria including experience, skills, and location. We don't ask about salary history. Offers are based on the role and what you bring to it. Some things you'll enjoy:

• Stock grant opportunities dependent on your role, employment status and location
• Additional perks and benefits based on your employment status and country
• Optional flexible working office membership, with IWG

At Deel, we're an equal-opportunity employer that values diversity and positively encourage applications from suitably qualified and eligible candidates regardless of race, religion, sex, national origin, gender, sexual orientation, age, marital status, veteran status, disability status, pregnancy or maternity or other applicable legally protected characteristics.