Security Architect

Responsibilities

• Conduct security architecture reviews across cloud platforms, applications, infrastructure, identity systems, and enterprise technologies, identifying security risks and recommending practical mitigations.
• Partner with Engineering, Product Security, Platform, and IT teams to incorporate security into system design, development, infrastructure provisioning, and deployment workflows.
• Perform threat modeling and security design assessments for Web and Mobile applications, APIs, cloud services, third-party integrations, and new technologies, identifying attack paths, trust boundaries, and sensitive data flows.
• Evaluate security controls across cloud and application environments, including IAM, workload identities, authentication, authorization, network segmentation, secrets management, encryption, and data protection.
• Develop and promote secure-by-default architecture patterns, reference designs, and reusable security controls that enable engineering teams to implement consistent security practices.
• Help translate security architecture requirements into automated guardrails, policy-as-code, and scalable security checks integrated into engineering and deployment workflows.
• Collaborate with Engineering teams to identify opportunities to reduce repetitive manual security reviews through standardized designs, preventive controls, and risk-based review approaches.
• Assess the security implications of AI-assisted software development, AI-enabled applications, and emerging agentic technologies, including access to sensitive data, tool integrations, identities, and permissions.
• Apply automation and AI-assisted analysis where appropriate to improve the efficiency and consistency of architecture assessments and threat modeling, while maintaining appropriate human oversight.
• Review findings from penetration tests, vulnerability assessments, cloud security monitoring, and incidents to identify systemic architectural weaknesses and recommend sustainable improvements.
• Provide technical security guidance on new technologies, strategic integrations, and architectural changes, balancing security requirements with performance, scalability, and business needs.
• Help translate applicable security policies and regulatory requirements into practical technical architecture controls.
• Document architecture assessments, technical recommendations, security patterns, and design decisions in a clear, actionable format.
• Partner with the Security Architecture Lead to strengthen architecture standards, improve review practices, and expand the adoption of scalable security controls across WHOOP.

Qualifications

• 7+ years of experience in cloud security, application security, or security architecture, with demonstrated experience designing or evaluating secure systems.
• Strong technical expertise in cloud or application security architecture, with a solid understanding of identity, infrastructure, and modern software development practices.
• Experience conducting security architecture reviews, threat modeling, and technical risk assessments for complex systems.
• Ability to independently identify architectural risks, evaluate design tradeoffs, and recommend practical, scalable security solutions.
• Experience developing or implementing security controls, automation, or secure engineering practices within modern technology environments.
• Ability to evaluate system designs, technical documentation, and implementation approaches to identify security weaknesses.
• Strong communication and collaboration skills, with the ability to influence technical decisions and work effectively across engineering and security teams.

Preferred Qualifications

• Hands-on software development, cloud engineering, or infrastructure engineering experience.
• Experience with secure-by-default architecture patterns, policy-as-code, or automated security controls.
• Familiarity with AI-assisted development, AI-enabled applications, or emerging agentic technologies and their security implications.
• Experience working across multiple security domains or contributing to enterprise security architecture initiatives.
• Familiarity with relevant security or regulatory frameworks (NIST, ISO 27001, SOC 2, HIPAA, PCI DSS) or professional security certifications.

Additional information

This role is based in the WHOOP office located in Boston, MA. The successful candidate must be prepared to relocate if necessary to work out of the Boston, MA office.

Interested in the role, but don’t meet every qualification? We encourage you to still apply! At WHOOP, we believe there is much more to a candidate than what is written on paper, and we value character as much as experience. As we continue to build a diverse and inclusive environment, we encourage anyone who is interested in this role to apply.

The WHOOP compensation philosophy is designed to attract, motivate, and retain exceptional talent by offering competitive base salaries, meaningful equity, and consistent pay practices that reflect our mission and core values.

Pay and benefits

At WHOOP, we view total compensation as the combination of base salary, equity, and benefits, with equity serving as a key differentiator that aligns our employees with the long-term success of the company and allows every member of our corporate team to own part of WHOOP and share in the company’s long-term growth and success.

The U.S. base salary range for this full-time position is $155,000 - $195,000. Salary ranges are determined by role, level, and location. Within each range, individual pay is based on factors such as job-related skills, experience, performance, and relevant education or training.

In addition to the base salary, the successful candidate will also receive benefits and a generous equity package.

These ranges may be modified in the future to reflect evolving market conditions and organizational needs. While most offers will typically fall toward the starting point of the range, total compensation will depend on the candidate’s specific qualifications, expertise, and alignment with the role’s requirements.