Platform Security Architect

ph3Who We Are Is What We Do. /h3 pDeel is the all-in-one payroll and HR platform for global teams. Our vision is to unlock global opportunity for every person, team, and business. Built for the way the world works today, Deel combines HRIS, payroll, compliance, benefits, performance, and equipment management into one seamless platform. With AI-powered tools and a fully owned payroll infrastructure, Deel supports every worker type in 150+ countries—helping businesses scale smarter, faster, and more compliantly. /p h3Who We Are Is What We Do. /h3 pDeel is the all-in-one payroll and HR platform for global teams. Our vision is to unlock global opportunity for every person, team, and business. Built for the way the world works today, Deel combines HRIS, payroll, compliance, benefits, performance, and equipment management into one seamless platform. With AI-powered tools and a fully owned payroll infrastructure, Deel supports every worker type in 150+ countries—helping businesses scale smarter, faster, and more compliantly. /p h3Why should you be part of our success story? /h3 pAs the fastest-growing Software as a Service (SaaS) company in history, Deel is transforming how global talent connects with world-class companies – breaking down borders that have traditionally limited both hiring and career opportunities. We're not just building software; we're creating the infrastructure for the future of work, enabling a more diverse and inclusive global economy. In 2024 alone, we paid $11.2 billion to workers in nearly 100 currencies and provided healthcare and benefits to workers in 109 countries—ensuring people get paid and protected, no matter where they are. /p pOur momentum is reflected in our achievements and customer satisfaction: CNBC Disruptor 50, Forbes Cloud 100, Deloitte Fast 500, and repeated recognition on Y Combinator's top companies list – all while maintaining a 4.83 average rating from 15,000 reviews across G2, Trustpilot, Captera, Apple and Google. /p pYour experience at Deel will be a career accelerator. At the forefront of the global work revolution, you'll tackle complex challenges that impact millions of people's working lives. With our momentum—backed by a $17.3 billion valuation and $1 B in Annual Recurring Revenue (ARR) in just over five years—you'll drive meaningful impact while building expertise that makes you a sought-after leader in the transformation of global work. /p pDeel is seeking a Platform Security Architect to own the security of our platform from the code our engineers write to the cloud it runs on. In this role, you'll design, build, and evolve the security architecture across two layers that can't be secured in isolation: our applications and services, and the AWS and Kubernetes infrastructure beneath them. This is a hands‑on, high‑impact position at the core of Deel's security engineering function, not a governance or advisory seat. /p pD /p peel operates in over 100 countries, processes payroll for tens of thousands of companies, and handles sensitive employee and financial data at scale. Hundreds of engineers ship to that platform every day. Most real‑world breaches cross the line between application and infrastructure: a leaked secret in code opens a cloud account, an over‑permissioned workload turns a small bug into a data breach. We need one architect who sees the whole path. You'll partner closely with Engineering, Infrastructure, Product, and Privacy/Compliance to build systems that are secure by default, without becoming a bottleneck to the fast‑moving teams that depend on you. /p h3Responsibilities /h3 ul liOwn the platform security architecture strategy across Deel's applications, services, and cloud environments, with a primary focus on AWS. Define secure design patterns, reference architectures, guardrails, and baseline configurations that teams build against by default. /li liRun Deel's security tooling as one program. Operate and tune Wiz for cloud posture (CSPM) and runtime visibility, and Aikido for SAST, SCA, secrets detection, container, IaC, and DAST scanning. Connect findings across code and cloud so the team fixes what is actually exploitable, not what is merely noisy. /li liDesign identity and access at every layer. Own least‑privilege cloud IAM (cross‑account roles, permission boundaries, SCPs, just‑in‑time access) and application authentication and authorization (session and token handling, multi‑tenant isolation, object‑level access control). /li liEmbed security into the SDLC and CI/CD pipelines. Build the guardrails for application code and Infrastructure as Code alike, with a clear model for what blocks a build and what warns. /li liSecure containers and Kubernetes. Set the standards for image hardening and signing, admission control, pod security, network policies, secrets management, and runtime protection. /li liOwn software supply chain security. Cover dependency and transitive risk, malicious package detection, SBOMs, build integrity, and artifact provenance, from the first npm install to the running workload. /li liLead threat modeling for new and existing systems, and make it part of how engineering designs software rather than a security‑team ritual. /li liRun vulnerability management for findings from scanners, pentests, and bug bounty: triage, exploitability assessment, SLAs, remediation partnership with engineering, and reporting on risk reduction over time. /li liLead platform security incident response across application and cloud layers: triage, containment, forensics, root cause analysis, and post‑incident hardening. /li liPartner with Privacy/Compliance so platform controls satisfy SOC 2 Type II, ISO 27001, PCI DSS, and GDPR, and design decisions stay defensible and auditable. /li liScale security through people. Build a Security Champions program and secure coding enablement so security knowledge spreads across engineering instead of pooling in the security team. /li liAct as the technical authority on platform security, reviewing high‑risk designs, evaluating vendors, and influencing engineering and cloud strategy at the leadership level. /li liUse Artificial Intelligence as an enabler to find new insights, learn from past mistakes, and continuously improve Deel's security posture, including securing the AI features Deel ships. /li /ul h3Qualifications /h3 ul li5+ years of hands‑on experience in cybersecurity, with real depth in both cloud security and application security engineering or architecture. /li liDeep AWS security expertise: IAM design, network controls, logging and monitoring (CloudTrail, Security Hub, GuardDuty), and data protection. /li liDeep application security expertise: OWASP Top 10 and API Security Top 10, authentication and authorization design, injection and deserialization, SSRF, business logic flaws, and secure session handling. /li liProven hands‑on experience operating security platforms such as Wiz (or Orca, Prisma Cloud) and Aikido (or Snyk, Semgrep, GitHub Advanced Security), including rollout, tuning, false‑positive reduction, and integration with engineering workflows. /li liStrong experience building security gates into CI/CD pipelines for both application code and Infrastructure as Code. /li liStrong experience securing containers and Kubernetes: image hardening, runtime security, pod security standards, and Kubernetes RBAC. /li liHands‑on threat modeling experience (STRIDE, attack trees, or equivalent) applied to real systems, with findings turned into concrete engineering work. /li liAbility to read, reason about, and write production code in at least one modern language (TypeScript/Node.js, Python, Go, or Java). /li liExperience with secrets management (HashiCorp Vault, AWS Secrets Manager) and encryption patterns for data at rest and in transit. /li liExperience running vulnerability management or a bug bounty/pentest program, and driving remediation across teams you don't manage. /li liStrong working knowledge of SOC 2 Type II, ISO 27001, PCI DSS, and GDPR. /li liAbility to turn complex security concepts into clear guidance for engineers and risk‑based recommendations for executives. /li liExcellent English, written and verbal. /li /ul h3Advantageous Experience /h3 ul liBackground in software engineering, DevSecOps, or platform engineering before moving into security. Credibility with engineers and the ability to ship fixes, not just file tickets. /li liOffensive security background (web/API or cloud penetration testing, exploit development, CTFs) used to inform defensive design. /li liExperience securing multi‑tenant SaaS at scale, including tenant isolation and EU data residency requirements. /li liExperience securing AI/LLM‑powered features (prompt injection, agent and tool abuse, data leakage) or applying AI to security workflows such as triage and automated remediation. /li liMulti‑cloud experience (GCP or Azure alongside AWS). /li liFamiliarity with eBPF‑based runtime tooling (Wiz, Cilium, Falco, or similar). /li liExperience building a Security Champions program or secure coding curriculum. /li liExperience in high‑growth fintech or global HR technology with complex regulatory requirements. /li liOpen‑source contributions, CVE credits, published research, or conference talks (OWASP Global AppSec, fwd:cloudsec, re:Inforce, BSides, Black Hat, DEF CON). /li liRelevant certifications: AWS Certified Security Specialty, OSWE, OSCP, GWAPT, CSSLP, CCSP, or CISSP. /li /ul h3Total Rewards /h3 pOur workforce deserves fair and competitive pay that meets them where they are. With scalable benefits, rewards, and perks, our total rewards programs reflect our commitment to inclusivity and access for all. /p ul liOur salary range reflects gross base salary. For commercial roles with commission eligibility, this figure represents On‑Target Earnings (OTE), inclusive of base salary and target commission. /li liSalary ranges are quoted in USD as a consistent global reference. Your offer will be localized to your country's currency using a market‑aligned conversion. /li liFinal pay is based on objective, job‑related criteria including experience, skills, and location. /li liWe don't ask about salary history. Offers are based on the role and what you bring to it. /li /ul h3Some things you'll enjoy /h3 ul liStock grant opportunities dependent on your role, employment status and location /li liAdditional perks and benefits based on your employment status and country /li liOptional flexible working office membership, with IWG /li /ul pAt Deel, we’re an equal‑opportunity employer that values diversity and positively encourage applications from suitably qualified and eligible candidates regardless of race, religion, sex, national origin, gender, sexual orientation, age, marital status, veteran status, disability status, pregnancy or maternity or other applicable legally protected characteristics. /p pUnless otherwise agreed, we will communicate with job applicants using Deel‑specific emails, which include @deel.com and other acquired company emails like @payspace.com and @paygroup.com. You can view the most up‑to‑date job listings at Deel by visiting our careers page. /p pDeel welcomes persons with disabilities to apply to any of our open roles. We will provide application and/or interview accommodations on request throughout the recruitment, selection and assessment process for applicants with disabilities or other needs. If you require application and/or interview accommodations, please inform our Talent Acquisition Team via email ( ) and a team member will be in touch to ensure your equal participation. /p pAs part of our hiring process, we primarily rely on interviews and role‑related assessments. In limited cases, we may also consider informal background information relevant to the role, in line with our privacy and fairness obligations. /p pThis application process may utilise Automated Employment Decision Tools (AEDT) and AI systems to assist in evaluating candidates based on experience level, technical skills and qualifications. This processing is conducted in compliance with applicable Data Protection, AI Governance and Labour Laws. We ensure human oversight is maintained in all final hiring decisions. Your personal data is not used to train AI models. For more information on how we process your personal data, please see our Recruitment Privacy Policy. /p pFor NYC Residents: In accordance with NYC Local Law 144, an independent bias audit has been conducted on AEDT. /p /p #J-18808-Ljbffr