Solution Architect, Armis/Veza

This is a fully remote position, open to applicants in Spain.

📋 Description

• Oversee the Application Security program for all Armis products and integrate security throughout the Software Development Life Cycle (SDLC).

• Conduct secure design and architectural reviews in collaboration with engineering teams.

• Facilitate threat modeling sessions utilizing methodologies such as STRIDE, DREAD, or PASTA.

• Manage application-layer vulnerability handling within Armis’ VIPR strategy, from detection to remediation and validation.

• Consolidate findings from SAST, DAST, SCA, and API testing into centralized vulnerability workflows, risk scoring, and prioritization models.

• Correlate application vulnerabilities with asset context, exploit intelligence, and business importance.

• Monitor and report on Mean Time to Detection (MTTD), Mean Time to Recovery (MTTR), exposure windows, and the effectiveness of remediation efforts.

• Create and sustain automated Application Security pipelines for SAST, DAST, SCA, and API security assessments.

• Embed security scanning into CI/CD pipelines, including GitHub Actions, Jenkins, and Buildkite.

• Collaborate with Cloud and Infrastructure Security teams to secure APIs, microservices, Docker, and Kubernetes workloads.

• Formulate and uphold secure coding standards and security baselines for technologies such as React, Node.js, Python, Java, and Go.

• Mentor engineers and security champions while providing secure coding education and leading threat modeling workshops.

• Counsel engineering leadership by translating vulnerabilities into risk assessments and remediation strategies.

• Assist in achieving SOC 2, ISO 27001, FedRAMP, and HIPAA compliance and audit readiness.

⛳️ Requirements

• Residency in Spain is mandatory.

• 7–10+ years of experience in Application Security, Product Security, or Secure Software Engineering.

• Demonstrated proficiency in SAST, DAST, SCA, and dependency management tools, including Veracode, Checkmarx, Fortify, Snyk, SonarQube, and OWASP Dependency-Check.

• Experience in a SaaS, cloud-native, or cybersecurity product environment is preferred.

• Practical experience integrating Application Security into VIPR or exposure management initiatives is desirable.

• Familiarity with Prisma Cloud, Wiz, or Orca is a plus.

• Experience with Terraform or CloudFormation is preferred.

• Knowledge of API Gateway security, OAuth2, token-based authentication, and zero-trust architectures is advantageous.

• Relevant certifications such as OSWE, CSSLP, GWAPT, GWEB, or CEH are preferred.

• Proficiency in coding with at least two of the following: Python, JavaScript/TypeScript, Java, and Go.

• Extensive experience managing vulnerabilities from end-to-end, including triage, prioritization, remediation tracking, and validation.

• In-depth understanding of OWASP Top 10, CWE, CVE, and exploitability concepts.

• Strong knowledge of CI/CD pipelines, Git-based workflows, and secure build automation practices.

• Experience with threat modeling, secure architecture reviews, and microservices/API security.

• Capability to communicate technical risks effectively to engineering teams and business stakeholders.

🏝️ Benefits

• Full-time regular employee position.

• Flexible or remote work options available.

• Accessible and inclusive application experience.

• Support for reasonable accommodations during the application process.