Whoop Security Architect to strengthen and scale security architecture across WHOOP's technology environment. Conduct security reviews and develop secure design practices for cloud and application systems.
Responsibilities
Conduct security architecture reviews across cloud platforms, applications, infrastructure, identity systems, and enterprise technologies, identifying security risks and recommending practical mitigations.
Partner with Engineering, Product Security, Platform, and IT teams to incorporate security into system design, development, infrastructure provisioning, and deployment workflows.
Perform threat modeling and security design assessments for Web and Mobile applications, APIs, cloud services, third-party integrations, and new technologies, identifying attack paths, trust boundaries, and sensitive data flows.
Evaluate security controls across cloud and application environments, including IAM, workload identities, authentication, authorization, network segmentation, secrets management, encryption, and data protection.
Develop and promote secure-by-default architecture patterns, reference designs, and reusable security controls that enable engineering teams to implement consistent security practices.
Help translate security architecture requirements into automated guardrails, policy-as-code, and scalable security checks integrated into engineering and deployment workflows.
Collaborate with Engineering teams to identify opportunities to reduce repetitive manual security reviews through standardized designs, preventive controls, and risk-based review approaches.
Assess the security implications of AI-assisted software development, AI-enabled applications, and emerging agentic technologies, including access to sensitive data, tool integrations, identities, and permissions.
Apply automation and AI-assisted analysis where appropriate to improve the efficiency and consistency of architecture assessments and threat modeling, while maintaining appropriate human oversight.
Review findings from penetration tests, vulnerability assessments, cloud security monitoring, and incidents to identify systemic architectural weaknesses and recommend sustainable improvements.
Provide technical security guidance on new technologies, strategic integrations, and architectural changes, balancing security requirements with performance, scalability, and business needs.
Help translate applicable security policies and regulatory requirements into practical technical architecture controls.
Qualification
Ability to evaluate system designsHands-on software developmentInterested in the role
Required
7+ years of experience in cloud security, application security, or security architecture, with demonstrated experience designing or evaluating secure systems.
Strong technical expertise in cloud or application security architecture, with a solid understanding of identity, infrastructure, and modern software development practices.
Experience conducting security architecture reviews, threat modeling, and technical risk assessments for complex systems.
Ability to independently identify architectural risks, evaluate design tradeoffs, and recommend practical, scalable security solutions.
Experience developing or implementing security controls, automation, or secure engineering practices within modern technology environments.
Ability to evaluate system designs, technical documentation, and implementation approaches to identify security weaknesses.
Strong communication and collaboration skills, with the ability to influence technical decisions and work effectively across engineering and security teams.
Preferred
Hands-on software development, cloud engineering, or infrastructure engineering experience.
Experience with secure-by-default architecture patterns, policy-as-code, or automated security controls.
Familiarity with AI-assisted development, AI-enabled applications, or emerging agentic technologies and their security implications.
Experience working across multiple security domains or contributing to enterprise security architecture initiatives.
Familiarity with relevant security or regulatory frameworks (NIST, ISO 27001, SOC 2, HIPAA, PCI DSS) or professional security certifications.
This role is based in the WHOOP office located in Boston, MA. The successful candidate must be prepared to relocate if necessary to work out of the Boston, MA office.
Interested in the role, but don’t meet every qualification? We encourage you to still apply! At WHOOP, we believe there is much more to a candidate than what is written on paper, and we value character as much as experience. As we continue to build a diverse and inclusive environment, we encourage anyone who is interested in this role to apply.
WHOOP is an Equal Opportunity Employer and participates in E-verify to determine employment eligibility
