The ad says“Strong understanding of application security, secure software development, infrastructure security, cloud security, API security, identity and access management, enterprise networking, and modern security architecture principles”
The ad says“Strong understanding of application security, secure software development, infrastructure security, cloud security, API security, identity and access management, enterprise networking, and modern security architecture principles”
The ad says“Demonstrated experience designing and securing cloud-native applications and infrastructure, with deep knowledge of AWS security services and modern cloud architecture”
The ad says“Strong understanding of application security, secure software development, infrastructure security, cloud security, API security, identity and access management, enterprise networking, and modern security architecture principles”
The ad says“Strong understanding of application security, secure software development, infrastructure security, cloud security, API security, identity and access management, enterprise networking, and modern security architecture principles”
The ad says“Strong understanding of application security, secure software development, infrastructure security, cloud security, API security, identity and access management, enterprise networking, and modern security architecture principles”
The ad says“Strong understanding of application security, secure software development, infrastructure security, cloud security, API security, identity and access management, enterprise networking, and modern security architecture principles”
The ad says“Strong understanding of application security, secure software development, infrastructure security, cloud security, API security, identity and access management, enterprise networking, and modern security architecture principles”
The ad says“Strong understanding of application security, secure software development, infrastructure security, cloud security, API security, identity and access management, enterprise networking, and modern security architecture principles”
The ad says“Experience performing architecture reviews, security design assessments, and threat modeling for complex distributed systems”
Values
The ad says“Professional security certifications such as CISSP, CCSP, AWS Certified Security – Specialty, GIAC, TOGAF, or equivalent are considered a plus”
The ad says“Professional security certifications such as CISSP, CCSP, AWS Certified Security – Specialty, GIAC, TOGAF, or equivalent are considered a plus”
The ad says“Professional security certifications such as CISSP, CCSP, AWS Certified Security – Specialty, GIAC, TOGAF, or equivalent are considered a plus”
The ad says“Professional security certifications such as CISSP, CCSP, AWS Certified Security – Specialty, GIAC, TOGAF, or equivalent are considered a plus”
The ad says“Professional security certifications such as CISSP, CCSP, AWS Certified Security – Specialty, GIAC, TOGAF, or equivalent are considered a plus”
WHOOP is seeking a Security Architect to help build and scale the Security Architecture function within the Information Security organization
This role will play a foundational part in defining how security architecture is practiced across the company by establishing standards, governance, reusable design patterns, and trusted partnerships with engineering teams
The successful candidate will bring broad technical expertise across application, infrastructure, cloud, and enterprise security while building strong relationships throughout the organization
They will help create practical security standards, influence technical strategy, mentor engineering teams, and enable the business to move quickly without compromising security
Working closely with the Security Architecture Lead and the broader CISO organization, this individual will help shape the long-term vision and operating model for Security Architecture at WHOOP
Partner with Engineering, Product, Infrastructure, IT, and Security teams to provide architectural guidance throughout the software development lifecycle, ensuring security is incorporated early into design decisions
Help establish and mature WHOOP’s Security Architecture practice by defining architecture governance, review methodologies, security standards, and engagement models that scale with the organization
Develop and maintain security architecture principles, standards, reference architectures, and reusable design patterns that enable engineering teams to build secure systems consistently
Review application, cloud, infrastructure, AI, and enterprise technology initiatives to identify architectural risks, validate security controls, and recommend practical mitigation strategies
Lead architecture reviews and collaborate with engineering teams on threat models, trust boundaries, data flows, identity patterns, secure service-to-service communications, and security design decisions
Provide technical leadership across application security, cloud security, infrastructure security, API security, identity and access management, secrets management, network security, and data protection
Work closely with Product Security, Infrastructure Security, and Engineering teams to establish consistent security expectations across new products, internal platforms, and third-party integrations
Evaluate the security architecture of strategic vendors and technology solutions as part of WHOOP’s Third-Party Risk Assessment process
Translate regulatory and compliance requirements—including HIPAA, PCI DSS, ISO 27001, SOC 2, and NIST frameworks—into practical engineering guidance and architectural controls
Mentor engineers and security team members on secure design principles, helping raise the organization’s overall security maturity through collaboration, education, and trusted technical leadership
Produce clear architectural documentation, technical standards, design reviews, and implementation guidance that can be consistently applied across engineering teams
Partner with Security leadership to define the long-term vision, operating model, roadmap, and success metrics for Security Architecture as a strategic capability within the Information Security organization
Serve as a trusted advisor to engineering and business leaders, balancing security, operational efficiency, and business objectives while promoting a secure-by-design culture across WHOOP
Benefits
Flexible Vacation: WHOOP has a flexible vacation policy that allows you to unwind, laptop-free, when you need it most.
Focus on Family: We offer 18 weeks paid parental leave, plus an additional 2 weeks to gradually return to work.
Get Invested: In addition to a competitive base salary and 401k, you’re eligible to receive stock options to share in the future of WHOOP.
WHOOP +1: Everyone on the team gets a complimentary WHOOP membership—plus another membership to share with a loved one.
Health Matters: Our competitive benefits package covers medical, dental, and vision, in addition to mental health services, life and disability insurance, and more.
Find Your Fit: Full-time employees get $500 a year to spend on wellness in whatever way they see fit, from fitness classes and memberships, to recovery services.
It Pays to Sleep: Our Sleep Performance Program incentivizes employees to get more sleep. Log an average sleep performance of 85% or higher for the month and get a $100 bonus.
Location, Location, Location: You can’t beat the views from the rooftop of One Kenmore Square. Feel inspired daily as you work, enjoy free snacks and coffee, and collaborate in the heart of Boston.
Preferred experience
This role requires someone who enjoys working with people as much as solving technical problems and can translate complex security concepts into clear, actionable guidance
Comfortable working independently while helping establish new security processes, standards, governance models, and architectural practices in a growing organization
Previous software engineering or application development experience with the ability to understand application design, architecture, implementation tradeoffs, and engineering workflows
Exceptional interpersonal, written, and verbal communication skills with a proven ability to build trust, influence technical decisions, and collaborate effectively across engineering, product, IT, and security organizations
High integrity, sound judgment, intellectual curiosity, and a pragmatic, solution-oriented approach to solving complex security challenges
Strong understanding of application security, secure software development, infrastructure security, cloud security, API security, identity and access management, enterprise networking, and modern security architecture principles
8–12+ years of experience in security architecture, application security, cloud security, infrastructure security, or senior security engineering roles supporting modern distributed systems
Ability to balance security requirements with business objectives and provide practical, risk-based recommendations that engineering teams can successfully implement
Demonstrated experience designing and securing cloud-native applications and infrastructure, with deep knowledge of AWS security services and modern cloud architecture
Professional security certifications such as CISSP, CCSP, AWS Certified Security – Specialty, GIAC, TOGAF, or equivalent are considered a plus
A collaborative, approachable, and service-oriented mindset with the ability to establish strong working relationships across teams and become a trusted partner to engineers and technical leaders
Experience performing architecture reviews, security design assessments, and threat modeling for complex distributed systems
Familiarity with healthcare, regulated environments, or security programs supporting HIPAA, PCI DSS, ISO 27001, SOC 2, NIST 800-53, or similar regulatory and compliance frameworks
Interested in the role, but don’t meet every qualification? We encourage you to still apply! At WHOOP, we believe there is much more to a candidate than what is written on paper, and we value character as much as experience. As we continue to build a diverse and inclusive environment, we encourage anyone who is interested in this role to apply
