Security Architect

Millions of people trust Flo with their most personal health data. As our Security Architect, you’ll make sure we deserve that trust. This is a hands-on individual contributor role. You’ll work side by side with engineering, product and platform teams to shape secure architectures and build the guardrails that let both humans and AI coding agents ship quickly and safely. The role combines security architecture, product and application security engineering and security risk expertise: you will set secure patterns and standards, lead threat modelling and design reviews, embed security into the SDLC and CI/CD, and translate security risk into clear, pragmatic decisions.

What you’ll do

• Shape secure architecture from day one. Partner with teams early in design, lead security design reviews for new services and major changes, and record key decisions and risk trade-offs.
• Build security harnesses for human and AI-agent development. Design guardrails, sandboxing, least-privilege access for agents and tools, secrets handling, policy-as-code and automated checks that run inside developer and agent workflows.
• Lead on AI and agentic security. Define secure patterns for LLM integrations, MCP servers and tool use, and tackle risks like prompt injection, data leakage, excessive agency and supply-chain compromise.
• Create paved roads. Publish reusable patterns, reference architectures and standards that teams adopt because they’re the easiest option.
• Scale threat modelling. Build tools and skills that let engineers run threat models themselves, and carry out internal security assessments.
• Remove whole classes of vulnerabilities. Automate vulnerability triage and investigation, find systemic root causes, and feed the fixes back into patterns and guardrails.
• Turn risk into clear decisions. Explain security risk in pragmatic terms so the business can prioritise based on risk and value.
• Advise and enable. Be a trusted partner to engineering, product and leadership, coach engineers, and help evaluate third-party and AI tools so they can be adopted securely. Support ISO 27001/27701 so that controls are built into how we engineer, not bolted on afterwards.

What you’ll bring

• 7+ years in security engineering, application/product security or security architecture, including hands-on work securing cloud-native systems
• Deep knowledge of Secure SDLC: threat modelling, security testing, app security review and CI/CD security
• Hands-on experience with AWS and Cloudflare (or equivalents) and Terraform or similar IaC
• A strong grasp of the OWASP Top 10 and the ability to assess exploitability and impact
• Solid coding skills (e.g. Python, Go, Scala) and experience building security tooling or automation
• Practical understanding of the risks in AI-assisted and agentic development and LLM applications (e.g. OWASP Top 10 for LLMs)
• Experience with security risk analysis and risk management methods
• The ability to explain trade-offs clearly to engineers and senior stakeholders, and to win people over

Nice to have

• Experience building guardrails, sandboxes or policy-as-code (e.g. OPA) for developer platforms or AI coding agents
• iOS or Android security experience
• Experience with ISO 27001, ISO 27701 or SOC 2 audits
• A background in health tech, femtech or another regulated, privacy-sensitive industry
• Certifications or degrees such as CISSP, CCSP, OSCP or an MSc in Information Security

Why Flo

You’ll protect data that matters deeply to millions of people. You’ll also help set the standard for how a company adopts agentic engineering safely, and you’ll have real ownership: you design and build the first version, then hand it off to the teams who will run it.