Asks for

The ad says“Deep application and API security knowledge, including the common vulnerability classes (for example access-control flaws, injection, and SSRF), secure design patterns, authentication and authorization, and secure SDLC practices.”
The ad says“Deep application and API security knowledge, including the common vulnerability classes (for example access-control flaws, injection, and SSRF), secure design patterns, authentication and authorization, and secure SDLC practices.”
The ad says“Strong command of cloud security, including network segmentation, IAM, secrets and key management, and workload and container security, along with infrastructure-as-code.”
The ad says“Solid, current understanding of industry and regulatory security and privacy requirements, such as SOC 2, ISO/IEC 27001, GDPR, and related frameworks, and the judgment to apply them proportionately.”
The ad says“Strong command of cloud security, including network segmentation, IAM, secrets and key management, and workload and container security, along with infrastructure-as-code.”
The ad says“Strong command of cloud security, including network segmentation, IAM, secrets and key management, and workload and container security, along with infrastructure-as-code.”
The ad says“Solid, current understanding of industry and regulatory security and privacy requirements, such as SOC 2, ISO/IEC 27001, GDPR, and related frameworks, and the judgment to apply them proportionately.”
The ad says“Strong command of cloud security, including network segmentation, IAM, secrets and key management, and workload and container security, along with infrastructure-as-code.”
The ad says“Strong command of cloud security, including network segmentation, IAM, secrets and key management, and workload and container security, along with infrastructure-as-code.”
The ad says“Deep application and API security knowledge, including the common vulnerability classes (for example access-control flaws, injection, and SSRF), secure design patterns, authentication and authorization, and secure SDLC practices.”
The ad says“Solid, current understanding of industry and regulatory security and privacy requirements, such as SOC 2, ISO/IEC 27001, GDPR, and related frameworks, and the judgment to apply them proportionately.”
The ad says“Strong command of cloud security, including network segmentation, IAM, secrets and key management, and workload and container security, along with infrastructure-as-code.”

About AiPrise

AiPrise is a global compliance orchestration platform helping fintechs, marketplaces, and payment companies verify and onboard customers worldwide. We integrate with 80+ identity and compliance vendors to deliver a holistic view of risk. We're now building AI-powered compliance agents to revolutionize KYB, AML, sanctions screening, and risk scoring — enabling our customers to onboard faster, reduce manual reviews, and prevent financial crime.

About the Role

We are looking for a Security Architect to own the security architecture of our platform end to end, across infrastructure, applications, and APIs, and to be hands-on in making it better. This is a builder’s role, not a paper one. You will work shoulder to shoulder with engineers to find and fix real security issues, set the standards that keep them fixed, and translate a demanding regulatory landscape into practical controls the team can actually ship.

You will also be the technical face of security in the rooms that matter: with auditors, with enterprise customers’ security teams, and with regulators. You will join as an individual contributor with the depth to lead by doing, and as the security team grows you will have the opportunity to build and manage a team of your own.

What You’ll Do

Own the security architecture across cloud infrastructure, applications, and APIs, and evolve it as the platform grows into new products and regions.
Work directly with engineers to identify, prioritize, and remediate security issues in infrastructure, application code, and APIs, reviewing designs, pairing on fixes, and validating that they hold.
Perform threat modeling and security design reviews for new services and significant changes, and embed security into the development lifecycle (secure coding standards, code review, CI/CD controls, dependency and container security).
Define and maintain security standards, reference architectures, and hardening baselines, and drive their adoption across engineering.
Lead and coordinate security testing, including penetration tests, vulnerability management, and remediation tracking, and hold findings to closure within defined timelines.
Translate industry and regulatory security and privacy requirements into concrete technical and organizational controls, and keep them current as obligations change.
Own the technical side of audits and assessments, including industry and certification audits (for example SOC 2 and ISO 27001), enterprise-customer security reviews, and regulatory reviews, covering evidence, control mapping, and remediation of findings.
Represent security in customer-facing conversations, including security questionnaires, due-diligence calls, and trust discussions with prospects, customers, and their auditors.
Partner with the privacy and data-protection function to ensure controls meet GDPR and other applicable data protection requirements, with particular care for personal and biometric data.
Contribute to incident readiness and response, including detection, investigation, and post-incident improvement.
As the team grows, mentor and eventually manage junior security engineers, setting technical direction, reviewing work, and developing the team.

What We're Looking For

7 to 9 years of experience in security engineering, security architecture, or a closely related field, with a track record of securing production systems at scale.
Genuine hands-on technical depth. You can read and reason about application code, cloud infrastructure, and API design, and work with engineers to fix issues rather than only flagging them.
Strong command of cloud security, including network segmentation, IAM, secrets and key management, and workload and container security, along with infrastructure-as-code.
Deep application and API security knowledge, including the common vulnerability classes (for example access-control flaws, injection, and SSRF), secure design patterns, authentication and authorization, and secure SDLC practices.
Solid, current understanding of industry and regulatory security and privacy requirements, such as SOC 2, ISO/IEC 27001, GDPR, and related frameworks, and the judgment to apply them proportionately.
Demonstrated experience handling audits and assessments of multiple kinds (certification, enterprise-client, and regulatory), including preparing evidence and driving findings to closure.
Excellent stakeholder and customer-facing communication. You can explain security clearly and credibly to engineers, executives, auditors, and customers alike.
Sound risk judgment. You can balance security, business needs, and delivery, and make defensible decisions with incomplete information.

Nice to Have

Experience in fintech, regtech, identity verification, or another regulated, data-sensitive domain.
Experience handling personal or biometric and identity data and the associated privacy obligations.
Background in penetration testing, red teaming, or vulnerability research.
Familiarity with privacy frameworks and regulations beyond GDPR (for example regional data protection laws), and with DevSecOps practices and tooling.
Relevant certifications (for example CISSP, CCSP, OSCP, or privacy certifications such as CIPP or CIPT) are valued, but hands-on capability matters more.
Experience mentoring or leading engineers, with an interest in building and managing a team.

Growth and Leadership Track

This role is designed to grow. You will start as a hands-on individual contributor with real ownership of our security architecture. As the security function expands, you will have a clear path into leadership: building, mentoring, and managing a team while continuing to set technical direction.

About the interview

Introductory Discussion (Engineering Manager) – 45 mins
Security Deep Dive & Practical Assessment – 90 mins
Security Deep Dive – 60 mins
Founder & Culture Alignment – 45 mins