Platform Security Architect

About the role

Deel is looking for a Platform Security Architect to own the security of its global payroll and HR platform. You will design, build, and evolve security architecture across applications, services, and the AWS/Kubernetes infrastructure, ensuring security is embedded by default without slowing down fast‑moving engineering teams.

Key responsibilities

• Define and maintain platform security architecture strategy, secure design patterns, reference architectures, guardrails, and baseline configurations for AWS and Kubernetes.
• Operate and tune security tooling such as Wiz for cloud posture management and Aikido for SAST, SCA, secrets detection, container, IaC, and DAST scanning.
• Design and enforce least‑privilege IAM, cross‑account roles, permission boundaries, and just‑in‑time access, as well as application authentication, multi‑tenant isolation, and object‑level access control.
• Integrate security gates into SDLC and CI/CD pipelines for both code and Infrastructure as Code.
• Lead threat modeling, vulnerability management, and incident response across application and cloud layers.
• Partner with Privacy/Compliance to satisfy SOC 2 Type II, ISO 27001, PCI DSS, and GDPR requirements.

Required profile

• 5+ years of hands‑on cybersecurity experience with deep expertise in both cloud (AWS) and application security.
• Proven experience operating security platforms (Wiz, Aikido or equivalents) and integrating them into engineering workflows.
• Strong ability to translate complex security concepts into clear guidance for engineers and risk‑based recommendations for executives.
• Excellent written and verbal English communication skills.

Required skills

• AWS security (IAM, CloudTrail, Security Hub, GuardDuty, network controls, data protection)
• Kubernetes security (image hardening, pod security, network policies, runtime protection)
• Security tooling: Wiz, Aikido, Snyk, Semgrep, GitHub Advanced Security
• Application security standards: OWASP Top 10, API Security Top 10
• Programming languages: TypeScript/Node.js, Python, Go, Java
• Secrets management: HashiCorp Vault, AWS Secrets Manager
• Compliance frameworks: SOC 2 Type II, ISO 27001, PCI DSS, GDPR