Security Solutions Architect

About the Position

Building complex software/hardware systems securely.

Location: Kyiv, Lviv, Ukraine

Work type: Flexible Remote

Employment type: Full-time

Cossack Labs is looking for an Security Solutions Architect to join our Security team and work with us on building secure software and solutions for our customers. If you are interested in designing and building security solutions that address complex risks and threats, reviewing and implementing API protocols and subsystems, designing security controls, and working hand-in-hand with software developers to build secure systems - this could be the position for you.

Responsibilities

• Design complex, high-security systems. Architect security features, modules, and protocols in mission-critical software, ensuring alignment with business objectives, functional, and non-functional requirements.
• Perform Security Architecture Reviews (SARs) by conducting in-depth analysis of systems, components, API, data flow of sensitive data, data exchange with other systems.
• Search for security weaknesses in software designs from novel fields and areas.
• Perform risk analysis and threat modeling to evaluate available and missing security controls.
• Collaborate with stakeholders, including developers, product managers, and executives, to gather requirements and translate them into security architecture.
• Participate in SSDLC for our products and our customers’ products. Explain architecture choices, work together with developers to select security controls that would improve security without restricting usability/performance.
• Stay up to date with emerging security threats, vulnerabilities, and controls (read articles and papers, follow CVE updates, understand how threat landscape is changing, understand how to apply described ideas, read NIST guidelines).
• Dive into application security, infrastructure security, cloud and on-prem infrastructures, dedicated hardware, IoT security, ML security, and weird stuff beyond casual imagination with our team of skilled engineers. See example of our work.
• Share your work as conference talks, blog posts (see React Native security example, contribute to open-source standards like OWASP.

Requirements

• 2+ years as Solution Architect or similar position.
• Experience designing and implementing security controls in a technically diverse environment.
• Experience in performing design review for multi-component systems (web, cloud, hardware).
• Understanding security standards and methodologies (NIST, ISO, CMMI, SOC).
• Understanding SSDLC and its difficulties. OWASP SSDLC, NIST SSDF.
• Communication skills: you will communicate about security technical topics with both technical and non-technical audiences (C-level managers, developers, product owners).
• An overall understanding of what information security is, how real-world risks and threats affect the choice of security controls. How to combine detective, preventive, and corrective controls.
• Experience in popular security tools required for the job, or ability to learn them quickly.

Nice to Have

• Understanding risk management and threat modeling (NIST RMF, FAIR, STRIDE, MITRE ATT&CK).
• A certain area of expertise and deep interest: web, cloud, IoT, infrastructure – an area where you have “seen things” and ready to share experience.
• Experience with clouds: AWS, Azure, GCP, understanding the “cloud responsibility gap”.
• Basic knowledge in cryptography: understanding the differences between symmetric and asymmetric cryptography, hashing, KDF.
• Knowledge in one of several business domains: deftech, miltech, govtech, banking, finance, payment processing.
• Practical experience in any programming language.

Don’t see yourself in every requirement?

We’d still like to hear from you.

Hiring Process

1. Resume review – up to 5 business days.
2. Test task – estimated time 1-3 hours.
3. Introductory meeting with the Head of security engineering.
4. Technical interview with several team members.
5. Background check.
6. Offer discussion.

What to expect from us

• We build applications for clients, write code for developers, and document how it all works - for both.
• Everyone on the team is happy to help, but we also respect each other’s time and know how to find answers ourselves.
• Tech writing isn’t our favorite task, but we do create solid technical documentation when needed, and we’re lucky to have a tech writer to help with that.
• We prefer doing things right the first time over patching things endlessly later.
• We value healthy perfectionism, a sense of beauty in engineering, and a good sense of humor.

What we offer

• Opportunities to work across technologies and projects: cryptography, software engineering, information security, ML security controls, cryptographic protocols, hardware protection, reverse-resilient mobile apps, and web apps for millions of users.
• Quarterly performance reviews, regular one-on-one meetings with your manager, and ongoing support to help you succeed and grow professionally.
• Quarterly compensation reviews, aligning pay with performance and market benchmarks.
• Performance and reward bonuses.
• 21 business days of vacation, plus sick, mental health, and emergency days to use when genuinely needed.
• Combination of in-office and remote work as needed, flexible scheduling, and a winter slowdown period.
• Conferences, books, courses, internal knowledge sharing, workshops, writing blog posts and research papers, giving talks, and contributing to open-source parts of our products - choose what aligns with your professional goals.

About the Company

You’ll work alongside PhDs in information security and cryptography, contributors to infosec community standards, specialists in rare security topics, and business-centric security engineers with broad experience. Some have worked in infosec since the 1990s, helping shape the industry and write the standards it relies on today.

For newcomers, we offer detailed onboarding during the first weeks. At Cossack Labs you’ll discover what works for you and what you need to learn next, developing through hands-on work on challenging problems, mentoring, and continuous learning with personal development plans to guide your growth.

Working at Cossack Labs, you’ll be at the cutting edge of technology and real-world security projects alongside highly skilled professionals who genuinely care about building a safer and more secure future.

Apply for the Position

Our team will review your CV and provide feedback within 5 business days.