Solution Architect, Security

The Security and Information Technology team is missioned to run and operate security infrastructures, platforms and technologies, as well as to support cross-functional teams to protect our users, products and infrastructures. In this team you'll have a unique opportunity to have first-hand exposure to the strategy of the company in key security initiatives, especially in deploying and maintaining scalable and secure-by-design systems and solutions.

Our challenges are not your regular day-to-day technical problems; you'll be part of a team that's developing new solutions to new challenges of a kind not previously addressed by big tech. It's working fast, at scale, and we're making a difference.

The Security Solution Architect is a deeply hands-on individual contributor who personally designs end-to-end technical security architectures for assigned products. You read source code and infrastructure-as-code, trace data flows across microservices, reason about networking and trust boundaries at the protocol level, and author detailed, implementable designs yourself— from threat models through reference architectures, data-flow diagrams, and control specifications. You lead through technical depth, defending every decision at the level of cryptographic primitives, identity and key management, network segmentation, and service-to-service trust.

Subject-matter experts retain final authority in their domains; your value is the engineering-grade design work that makes their decisions concrete and buildable, rather than handing off a framework and orchestrating meetings.

• Author Compliance-by-Design Architectures:
  Translate abstract national-security, privacy, and policy requirements (e.g., NIST SP 800-53, data residency, access segregation) into concrete, buildable designs you write yourself: trust-boundary and data-flow diagrams, identity and key-management schemes, network segmentation, and service-to-service authentication (mTLS, request signing, token exchange). You specify protocols, message formats, crypto primitives, and failure modes in enough detail that engineering can build directly from your design.
• Reverse-Engineer Real Systems:
  Build an accurate model of how each product actually works by reading code, IaC, service manifests, and API contracts—mapping microservice topology, data flows, authn/authz paths, network paths, and trust boundaries and pinpoint exactly where controls must sit (telemetry, access segregation, data residency, encryption in transit and at rest).
• Threat Model and Prove Out Designs:
  Produce rigorous threat models (e.g., STRIDE/attack-tree) tied to the real architecture, enumerating failure modes, attacker capabilities, and the control mitigating each. Where feasible, validate hands-on through prototyping, proofs of concept, or testing actual behavior—so designs are demonstrably correct, not theoretical.
• Lead Deep Technical Design Reviews:
  Run reviews where you engage at the implementation level—challenging API contracts, key life cycles, segmentation, and data handling, not just checking boxes. Produce and maintain reference architectures, design specs, and Architecture Decision Records (ADRs) capturing concrete trade-offs (e.g., mTLS vs. per-message signing, KMS/HSM model, isolation boundary). You are accountable for the technical correctness and completeness of the design.
• Be the Front Door and Calibrate "Good Enough":
  Serve as the primary intake point for product teams seeking security architecture support, and partner with downstream security and privacy teams (TDR, Data Security, Infrastructure Security, Vulnerability Management, GRC, Privacy) to right-size controls to the actual threat—negotiating pragmatic,…