Security Architect (Prague or Košice)

Security Architect as a member of Engineering

• Is able to explain the general features of our product.
• Understands how customers deploy the product (basic deployment scenarios).
• Knows the main business and engineering goals.
• Knows the relevant release deadlines.
• Actively seeks the information needed for the work.
• Continuously works on gaining knowledge to do top-notch work.

As a Security Architect

• Owns the Security domain of the ecosystem and is accountable for the decisions that steer it.
• Designs the solution and technical architecture from the security perspective, and designs the security-critical components of the ecosystem.
• Sets the secure development practices the teams work to, and the regulatory adherence those practices have to satisfy.
• Helps development teams reach correct technical decisions — is consulted before a design is built, not after it fails a review.
• Proactively evaluates security threats and the security needs of customers, including threat modelling of cross-domain and integration flows.
• Owns the security governance of the cloud architecture, together with the Software Architect and the Platform Architect.
• Tracks the ITSec landscape — critical vulnerabilities affecting the stack, and the trends that will change what customers require of us.
• Owns the technical side of vulnerability response — assesses reported vulnerabilities, decides severity and the remediation sequence, and is accountable for the answer given to the customer.
• Communicates with external parties on security — customers' security teams, auditors, penetration testers — and translates their findings into work the teams can act on.
• Provides leadership, coaching and education on security for Engineering.
• Governs the security of AI usage — what product and customer data may reach an external model service, and the security implications of AI-assisted development, together with the Software Architect.

Experience and education

• University education in IT or a related field, or equivalent practical experience.
• Extensive IT experience with real hands-on background — this role is not credible without it. Years of experience are supporting evidence only; the decisive criteria are in Position level below.
• Demonstrated experience of owning security decisions in a product that customers audit.
• Experience with regulated or security-sensitive customers is a strong advantage.

Technical skills

• Security — authentication and authorisation (OAuth 2, JWT, ADFS, IAM, KeyCloak), tenancy and data protection, encryption in transit and at rest, secrets management.
• Threat modelling and secure design patterns; able to review someone else's design and name what is wrong with it.
• Penetration testing — able to direct it, interpret the findings and judge severity rather than forward a report.
• Integration — REST, ETL, messaging (RabbitMQ / AMQP), and the security consequences of each.
• Deployment — Docker, Kubernetes, cloud (AWS) and on-premise, and the different threat surface of each.
• Development process — CI/CD, dependency and supply-chain security, secure release practice.
• Data modelling (ERD, BPMN) and networking.
• Architecture design tools and patterns; cloud application design patterns and microservices.
• Broad familiarity with the languages in the product — Java, Kotlin, Python, C++, C#, Bash — sufficient to review security-relevant code.
• Contact centre domain knowledge, particularly recording, media handling and the data protection questions they raise.

AI skills

• Defines what product and customer data may reach an external model service, and under what controls.
• Able to assess AI-specific risk — prompt injection, data leakage through context, model and vendor dependency, and the auditability of a non-deterministic component.
• Sets the security rules for AI-assisted development, including what may not be pasted into an assistant and how AI-generated code is reviewed for security and licensing.
• Uses AI tooling in own work — threat modelling support, log and finding triage, drafting security documentation — with the same verification standard expected of everyone else.
• Knows and enforces the company rules for AI tool usage.

Other

• English — the working language of the company; able to face a customer's security team or an auditor directly.
• Holistic thinking and excellent communication — most of the job is persuading people to build it differently.
• Able to explain security risk in business terms, including the cost of not acting.
• Willing to deep-dive into unfamiliar topics as they arrive.

• Creative environment with a strong sense of ownership, living agile
• Opportunity to make decisions and change our product for the better
• Flexible home-office policy
• Flexible working hours – based on agreement with the team
• Global multinational environment; headquarter in Prague, and offices in Slovakia, and the USA
• Open and transparent environment
• Highly competitive salary
• Team events – company breakfasts, teambuilding
• Budget for training and conferences, internal knowledge share sessions
• Focus time – dedicated time for education, experiments, or working on open source projects