This position is open exclusively for Ukrainian residents within Ukraine (preferably Kyiv or Lviv).

Cossack Labs is looking for an Security Solutions Architect to join our Security team and work with us on building secure software and solutions for our customers. If you are interested in designing and building security solutions that address complex risks and threats, reviewing and implementing API protocols and subsystems, designing security controls, and working hand-in-hand with software developers to build secure systems — this could be the position for you.

What you’ll do #

• Design complex, high-security systems. Architect security features, modules and protocols in mission critical software, ensuring alignment with business objectives, functional and non-functional requirements.
• Perform Security Architecture Reviews (SARs) by conducting in-depth analysis of systems, components, API, data flow of sensitive data, data exchange with other systems.
• Search for security weaknesses in software designs from novel fields and areas.
• Perform risk analysis and threat modelling to evaluate available and missing security controls.
• Collaborate with stakeholders, including developers, product managers, and executives, to gather requirements and translate them into security architecture.
• Participate in SSDLC for our products and our customers’ products. Explain architecture choices, work together with developers to select security controls that would improve security without restricting usability/performance.
• Stay up to date with emerging security threats, vulnerabilities, and controls (read articles and papers, follow CVE updates, understand how threat landscape is changing, understand how to apply described ideas, read NIST guidelines).
• Dive into application security, infrastructure security, cloud and on-prem infrastructures, dedicated hardware, IoT security, ML security, and weird stuff beyond casual imagination with our team of skilled engineers. See example of our work.
• Share your work as conference talks, blogposts (see React Native security example, contribute to open source standards like OWASP.

Requirements #

• 2+ years as Solution Architect or similar position.
• Experience designing and implementing security controls in a technically diverse environment.
• Experience in performing design review for multi-component systems (web, cloud, hardware).
• Understanding security standards and methodologies (NIST, ISO, CMMI, SOC).
• Understanding SSDLC and its difficulties. OWASP SSDLC, NIST SSDF.
• Communication skills: you will communicate about security technical topics with both technical and non-technical audiences (C-level managers, developers, product owners).
• An overall understanding of what information security is, how real-world risks and threats affect the choice of security controls. How to combine detective, preventive and corrective controls.
• Experience in popular security tools required for the job, or ability to learn them quickly.

Nice to have #

• Understanding risk management and threat modelling (NIST RMF, FAIR, STRIDE, MITRE ATT&CK).
• A certain area of expertise and deep interest: web, cloud, IoT, infrastructure – an area where you have “seen things” and ready to share experience.
• Experience with clouds: AWS, Azure, GCP, understanding the “cloud responsibility gap”.
• Basic knowledge in cryptography: understanding the differences between symmetric and asymmetric cryptography, hashing, KDF.
• Knowledge in one of several business domains: deftech, miltech, govtech, banking, finance, payment processing.
• Practical experience in any programming language.

Hiring Process #

1. Resume review – up to 5 business days.
2. Test task – estimated time 1-3 hours.
3. Introductory meeting with the Head of security engineering.
4. Technical interview with several team members.
5. Background check.
6. Offer discussion.

What to expect from us #

• We build applications for clients, write code for developers, and document how it all works — for both.
• Everyone on the team is happy to help, but we also respect each other’s time and know how to find answers ourselves.
• Tech writing isn’t our favourite task, but we do create solid technical documentation when needed, and we’re lucky to have a tech writer to help with that.
• We prefer doing things right the first time over patching things endlessly later.
• We value healthy perfectionism, a sense of beauty in engineering, and a good sense of humour.

What we offer #

• Opportunities to work across technologies and projects: cryptography, software engineering, information security, ML security controls, cryptographic protocols, hardware protection, reverse-resilient mobile apps, and web apps for millions of users.
• Quarterly performance reviews, regular one-on-one meetings with your manager, and ongoing support to help you succeed and grow professionally.
• Quarterly compensation reviews, aligning pay with performance and market benchmarks.
• Performance and reward bonuses.
• 21 business days of vacation, plus sick, mental health, and emergency days to use when genuinely needed.
• Combination of in-office and remote work as needed, flexible scheduling, and a winter slowdown period.
• Conferences, books, courses, internal knowledge sharing, workshops, writing blog posts and research papers, giving talks, and contributing to open-source parts of our products — choose what aligns with your professional goals.

Why work at Cossack Labs? #

You’ll work alongside PhDs in information security and cryptography, contributors to infosec community standards, specialists in rare security topics, and business-centric security engineers with broad experience. Some have worked in infosec since the 1990s, helping shape the industry and write the standards it relies on today.

For newcomers, we offer detailed onboarding during the first weeks. At Cossack Labs you’ll discover what works for you and what you need to learn next, developing through hands-on work on challenging problems, mentoring, and continuous learning with personal development plans to guide your growth.

Working at Cossack Labs, you’ll be at the cutting edge of technology and real-world security projects alongside highly skilled professionals who genuinely care about building a safer and more secure future.