Security Architect

Job description

At WHOOP, we're on a mission to unlock human performance and healthspan. Our wearable technology provides personalized insights that help millions of members better understand their bodies, and make smarter decisions about training, recovery, and lifestyle. WHOOP is seeking a **Security Architect** to help build and scale the Security Architecture function within the Information Security organization. This role will play a foundational part in defining how security architecture is practiced across the company by establishing standards, governance, reusable design patterns, and trusted partnerships with engineering teams. The successful candidate will bring broad technical expertise across application, infrastructure, cloud, and enterprise security while building strong relationships throughout the organization. They will help create practical security standards, influence technical strategy, mentor engineering teams, and enable the business to move quickly without compromising security. This role requires someone who enjoys working with people as much as solving technical problems and can translate complex security concepts into clear, actionable guidance. Working closely with the Security Architecture Lead and the broader CISO organization, this individual will help shape the long-term vision and operating model for Security Architecture at WHOOP. ## **RESPONSIBILITIES** - Partner with Engineering, Product, Infrastructure, IT, and Security teams to provide architectural guidance throughout the software development lifecycle, ensuring security is incorporated early into design decisions. - Help establish and mature WHOOP's Security Architecture practice by defining architecture governance, review methodologies, security standards, and engagement models that scale with the organization. - Develop and maintain security architecture principles, standards, reference architectures, and reusable design patterns that enable engineering teams to build secure systems consistently. - Review application, cloud, infrastructure, AI, and enterprise technology initiatives to identify architectural risks, validate security controls, and recommend practical mitigation strategies. - Lead architecture reviews and collaborate with engineering teams on threat models, trust boundaries, data flows, identity patterns, secure service-to-service communications, and security design decisions. - Provide technical leadership across application security, cloud security, infrastructure security, API security, identity and access management, secrets management, network security, and data protection. - Work closely with Product Security, Infrastructure Security, and Engineering teams to establish consistent security expectations across new products, internal platforms, and third-party integrations. - Evaluate the security architecture of strategic vendors and technology solutions as part of WHOOP's Third-Party Risk Assessment process. - Translate regulatory and compliance requirements—including HIPAA, PCI DSS, ISO 27001, SOC 2, and NIST frameworks—into practical engineering guidance and architectural controls. - Mentor engineers and security team members on secure design principles, helping raise the organization's overall security maturity through collaboration, education, and trusted technical leadership. - Produce clear architectural documentation, technical standards, design reviews, and implementation guidance that can be consistently applied across engineering teams. - Partner with Security leadership to define the long-term vision, operating model, roadmap, and success metrics for Security Architecture as a strategic capability within the Information Security organization. - Serve as a trusted advisor to engineering and business leaders, balancing security, operational efficiency, and business objectives while promoting a secure-by-design culture across WHOOP. ## **QUALIFICATIONS** - 8–12+ years of experience in security architecture, application security, cloud security, infrastructure security, or senior security engineering roles supporting modern distributed systems. - Demonstrated experience designing and securing cloud-native applications and infrastructure, with deep knowledge of AWS security services and modern cloud architecture. - Strong understanding of application security, secure software development, infrastructure security, cloud security, API security, identity and access management, enterprise networking, and modern security architecture principles. - Previous software engineering or application development experience with the ability to understand application design, architecture, implementation tradeoffs, and engineering workflows. - Experience performing architecture reviews, security design assessments, and threat modeling for complex distributed systems. - Familiarity with healthcare, regulated environments, or security programs supporting HIPAA, PCI DSS, ISO 27001, SOC 2, NIST 800-53, or similar regulatory and compliance frameworks. - Ability to balance security requirements with business objectives and provide practical, risk-based recommendations that engineering teams can successfully implement. - Exceptional interpersonal, written, and verbal communication skills with a proven ability to build trust, influence technical decisions, and collaborate effectively across engineering, product, IT, and security organizations. - A collaborative, approachable, and service-oriented mindset with the ability to establish strong working relationships across teams and become a trusted partner to engineers and technical leaders. - Comfortable working independently while helping establish new security processes, standards, governance models, and architectural practices in a growing organization. - High integrity, sound judgment, intellectual curiosity, and a pragmatic, solution-oriented approach to solving complex security challenges. - Professional security certifications such as CISSP, CCSP, AWS Certified Security – Specialty, GIAC, TOGAF, or equivalent are considered a plus. ***This role is based in the WHOOP office located in Boston, MA. The successful candidate must be prepared to relocate if necessary to work out of the Boston, MA office.*** *Interested in the role, but don’t meet every qualification? We encourage you to still apply! At WHOOP, we believe there is much more to a candidate than what is written on paper, and we value character as much as experience. As we continue to build a diverse and inclusive environment, we encourage anyone who is interested in this role to apply.* *WHOOP is an Equal Opportunity Employer and participates in* [*E-verify*](https://www.e-verify.gov/) *to determine employment eligibility* *The WHOOP compensation philosophy is designed to attract, motivate, and retain exceptional talent by offering competitive base salaries, meaningful equity, and consistent pay practices that reflect our mission and core values.* *At WHOOP, we view total compensation as the combination of base salary, equity, and benefits, with equity serving as a key differentiator that aligns our employees with the long-term success of the company and allows every member of our corporate team to own part of WHOOP and share in the company’s long-term growth and success.* *The U.S. base salary range for this full-time position is $155,000 - $195,000. Salary ranges are determined by role, level, and location. Within each range, individual pay is based on factors such as job-related skills, experience, performance, and relevant education or training.* *In addition to the base salary, the successful candidate will also receive benefits and a generous equity package.* *These ranges may be modified in the future to reflect evolving market conditions and organizational needs. While most offers will typically fall toward the starting point of the range, total compensation will depend on the candidate’s specific qualifications, expertise, and alignment with the role’s requirements.*