Security Architect
Flo Health5 days ago
Vilnius, LithuaniaSenior
Responsibilities
- Partner with engineering, product, and platform teams to lead security design reviews and document architecture decisions and risk trade-offs.
- Design guardrails, sandboxing, least-privilege access, secrets handling, policy-as-code, and automated checks for developer and AI-agent workflows.
- Define secure patterns for LLM integrations, MCP servers, and tool use while addressing prompt injection, data leakage, excessive agency, and supply-chain risks.
- Create reusable security patterns, reference architectures, and standards that engineering teams can adopt.
- Build tools and capabilities for self-service threat modeling and conduct internal security assessments.
- Automate vulnerability triage and investigation, identify systemic root causes, and feed fixes into security patterns and guardrails.
- Translate security risks into pragmatic business and engineering decisions and advise stakeholders.
- Coach engineers, evaluate third-party and AI tools, and support ISO 27001 and ISO 27701 controls.
Requirements
- 7+ years of experience in security engineering, application/product security, or security architecture, including hands-on experience securing cloud-native systems.
- Deep knowledge of Secure SDLC practices, threat modeling, security testing, application security reviews, and CI/CD security.
- Hands-on experience with AWS and Cloudflare or equivalent technologies, and Terraform or similar infrastructure-as-code tools.
- Strong understanding of the OWASP Top 10 and the ability to assess exploitability and impact.
- Solid coding skills in languages such as Python, Go, or Scala, with experience building security tooling or automation.
- Practical understanding of AI-assisted and agentic development risks and LLM applications, including the OWASP Top 10 for LLMs.
- Experience with security risk analysis and risk management methods.
- Ability to communicate trade-offs clearly to engineers and senior stakeholders and gain stakeholder support.
- Experience building guardrails, sandboxes, or policy-as-code for developer platforms or AI coding agents is preferred.
- iOS or Android security experience is preferred.
- Experience with ISO 27001, ISO 27701, or SOC 2 audits is preferred.
- Experience in health tech, femtech, or another regulated and privacy-sensitive industry is preferred.
- Certifications or degrees such as CISSP, CCSP, OSCP, or an MSc in Information Security are preferred.
Benefits
- Competitive salary with annual reviews and participation opportunity in Flo’s performance incentive scheme.
- Paid holiday, sick leave, and female health leave.
- Enhanced parental leave and pay for maternity, paternity, same-sex, and adoptive parents.
- Professional growth through mission-driven work and learning support.
- Hybrid work model with three days per week in the office.
- Five-week fully paid sabbatical at the five-year Floversary.
- Flo Premium for friends and family, plus health, pension, and wellbeing perks.
About Flo Health
Flo Health builds a mobile app for menstrual cycle, ovulation, fertility, and pregnancy tracking, offering AI-powered insights and a private community on iOS and Android. The company operates a freemium model with optional premium subscriptions and health content. Founded in 2015 and headquartered in London, this privately held firm reports tens of millions of monthly active users, and its privacy-focused Anonymous Mode was named one of Time’s Best Inventions of 2023.