Threat Modeler

Role Overview

We are seeking an experienced Threat Modeler to identify, assess, and mitigate security risks across applications, systems, and cloud environments. The role involves designing threat models, reviewing architectures, supporting Dev Ops teams, and implementing security best practices throughout the software development lifecycle.

• Conduct threat modeling using STRIDE, PASTA, attack trees, and MITRE ATT&CK frameworks.
• Identify vulnerabilities using CWE, OWASP, and other industry standards.
• Review and assess technical architectures, providing actionable security recommendations.
• Define and track mitigating controls throughout the threat lifecycle.
• Develop automation tools to support threat modeling and security processes.
• Collaborate with Dev Ops and agile teams to ensure secure CI/CD pipelines, cloud deployments, and infrastructure-as-code practices.
• Support or perform penetration testing and security validations.
• Present threat findings and recommendations to technical teams and senior stakeholders.
• Maintain high standards of work with minimal supervision.
• Continuously improve threat modeling processes and practices.

• Minimum 6 years IT experience, with at least 4 years in Cybersecurity/Information Security.
• Threat modeling frameworks: STRIDE, PASTA, Attack Trees, MITRE ATT&CK.
• Vulnerability identification: CWE, OWASP.
• Security knowledge in authentication, authorization, logging/monitoring, encryption, network segmentation, and infrastructure security.
• Familiarity with operating systems hardening and development concepts (SDLC, CI/CD, pipelines).
• Scripting and Infrastructure as Code (Terraform, Cloud Formation), CDK, Git Ops.
• Experience with cloud platforms (AWS, Azure, GCP, Oracle Cloud).
• Dev Ops/Agile team experience and ticketing systems (Jira or equivalent).
• Understanding of Docker, Kubernetes, serverless, and Helm.
• Exposure to Snowflake, MongoDB, Databricks, Terraform Cloud, Git Hub.

• Bachelor’s degree in Computer Science, Information Technology, or equivalent work experience.

Cloud Certifications (Associate level preferred):

• AWS Certified Developer / Solutions Architect / Sys Ops Administrator
• CompTIA Cloud+
• Google Associate Cloud Engineer
• Oracle Cloud Infrastructure Certified Architect/Operations Associate
• Microsoft Azure Developer Associate

Cybersecurity Certifications (Associate or Professional):

• CISA, GSEC, SSCP, CompTIA CySA+
• Microsoft Security Operations Analyst Associate / Information Protection Administrator Associate