Security Solutions Architect

About the Position

We’re currently updating the website, some navigation elements may change during this process.

🇺🇦 We bring our capabilities to all institutions that help protect Ukraine across critical infrastructure, defence, and government.

Security Solutions Architect

Kyiv, Ukraine・Lviv, Ukraine・Full time・Flexible remote // Building complex software/hardware systems securely.

The Opportunity

This position is open exclusively for Ukrainian residents within Ukraine (preferably Kyiv or Lviv).

Cossack Labs is looking for an Security Solutions Architect to join our Security team and work with us on building secure software and solutions for our customers. If you are interested in designing and building security solutions that address complex risks and threats, reviewing and implementing API protocols and subsystems, designing security controls, and working hand-in-hand with software developers to build secure systems - this could be the position for you.

We are a data security solutions company, developing software products (open-source and proprietary), as well as providing custom bespoke solutions to innovative development teams around the world. Our mission is to make strong security methodologies and approaches convenient within modern infrastructures and, as the software is eating the world, help it eat the world responsibly, without leaking customer’s data.

Our software is well-known amongst security-aware teams, recommended by OWASP, and popular for easily solving complicated security challenges. Apart from building “off-the-shelf” solutions, we design custom security controls for novel problems.

We work in the B2B space, with customers such as power grid operators, payment processors, legal companies, million-user customer applications. We cater to young ambitious startups and well-established enterprises, who use our software and solutions as core part of their security arsenal. Our customers are smart, but extremely demanding.

Markets: EU, UK, USA.

You Will

• Design complex, high-security systems. Architect security features, modules and protocols in mission critical software, ensuring alignment with business objectives, functional and non-functional requirements.
• Perform Security Architecture Reviews (SARs) by conducting in-depth analysis of systems, components, API, data flow of sensitive data, data exchange with other systems.
• Search for security weaknesses in software designs from novel fields and areas.
• Perform risk analysis and threat modelling to evaluate available and missing security controls.
• Collaborate with stakeholders, including developers, product managers, and executives, to gather requirements and translate them into security architecture.
• Participate in SSDLC for our products and our customers’ products. Explain architecture choices, work together with developers to select security controls that would improve security without restricting usability/performance.
• Stay up to date with emerging security threats, vulnerabilities, and controls (read articles and papers, follow CVE updates, understand how threat landscape is changing, understand how to apply described ideas, read NIST guidelines).
• Dive into application security, infrastructure security, cloud and on-prem infrastructures, dedicated hardware, IoT security, ML security, and weird stuff beyond casual imagination with our team of skilled engineers. See example of our work.
• Share your work as conference talks, blogposts (see React Native security example, contribute to open source standards like OWASP.

We Would Expect You To Have

• 2+ years as Solution Architect or similar position.
• Experience designing and implementing security controls in a technically diverse environment.
• Experience in performing design review for multi-component systems (web, cloud, hardware).
• Understanding security standards and methodologies (NIST, ISO, CMMI, SOC).
• Understanding SSDLC and its difficulties. OWASP SSDLC, NIST SSDF.
• Communication skills: you will communicate about security technical topics with both technical and non-technical audiences (C-level managers, developers, product owners).
• An overall understanding of what information security is, how real-world risks and threats affect the choice of security controls. How to combine detective, preventive and corrective controls.
• Experience in popular security tools required for the job, or ability to learn them quickly.

As a Plus You’d Have

• Understanding risk management and threat modelling (NIST RMF, FAIR, STRIDE, MITRE ATT&CK).
• A certain area of expertise and deep interest: web, cloud, IoT, infrastructure – an area where you have “seen things” and ready to share experience.
• Experience with clouds: AWS, Azure, GCP, understanding the “cloud responsibility gap”.
• Basic knowledge in cryptography: understanding the differences between symmetric and asymmetric cryptography, hashing, KDF.
• Knowledge in one of several business domains: deftech, miltech, govtech, banking, finance, payment processing.
• Practical experience in any programming language.

Hiring Process

• Resume review – up to 5 business days.
• Test task – estimated time 1-3 hours.
• Introductory meeting with the Head of security engineering.
• Technical interview with several team members.
• Background check.
• Offer discussion.

Please note that you can be a perfect fit even if not everything we’ve outlined above applies to you. If you have any questions, please don’t hesitate to ask – everyone is unique.

We Offer

Unique Area of Expertise

• Interesting and challenging work in applied security engineering: from building to breaking. Working at the intersection of different areas: designing ML security controls, supporting cryptographic protocols with security controls, protecting hardware, building reverse-resilient mobile apps, securing web apps for million of users, etc.
• Public track record in the open source part of our products, sharing your work as blogs posts, research papers and conference talks. We work with innovative companies all over the world, move quickly and dive into technologies others just hear about.
• Combining technologies: cryptography, software engineering, information security. You won’t be bored :)
• A sense of meaning and responsibility for those who seek purpose - we’re building “invisible texture of modern civilization” - bits of infrastructure finance, power grids, healthcare rely on, and we are trusted with very challenging aspects of it.

Environment

• Friendly and experienced team: smart people to learn from, great people to build with. Each of us is unique, we value and support each other.
• An atmosphere that motivates you to grow and get smarter every month, a healthy ratio of routine / experimentation.
• Trust: schedule, reporting, bureaucracy is kept at reasonable minimum. We hire smart people and trust them to do the right thing. When things go wrong, we help rather than punish.
• Shared decision making: this business is driven by engineering excellence, so engineers are important part of tactical and strategical business decisions.
• Friendly to humans: not just a formal vacation and sick leave quota. Feel like your mental or physical wellbeing needs care? Take some time off. Feel like working a few days from home? Sure. As long as you’re in line, we are here to support you when you’re not.

Growth

• Team that facilitates internal learning and growth all the time.
• Interesting technologies to work with - sometimes, even unique ones (we design applied cryptography schemes and techniques and novel ways to use them).
• Interesting engineering challenges across the board, ability to hop from high-level system design to protocol reverse engineering and clever data modelling hacks.
• Management attention to help you improve upon your personal goals (through 1:1s and mentoring).

Benefits

• Competitive compensation with flexible bonus scheme.
• Sick leaves, 21 business days for vacation per year, extra days off - according to the agreements and laws.
• Conferences, books, courses - we encourage learning and sharing with the community. Our team members share a lot in talks, workshops and blog posts.

Not Sure But Considering? Talk to Us.

If you see yourself fit but a few things are off - don’t hesitate to talk anyway. It might be that your unique combination of skills and knowledge would be perfectly fitting for our environment, but we both just don’t know it yet.

How to Apply

We'd like to get your CV to start a conversation. A supporting letter explaining your story and experience in application security, what you have done in the past and what kind of work you find interesting would help, but is not necessary.

Check Out the Recent Customer Story

ML models

Industrial

IIoT security: protecting specialised edge ML devices

Designing and implementing security of specialised IIoT devices that run ML. Data protection, ML models protection, secure communication, fleet management, and anti-reverse engineering.

Read story

All customer stories