Senior Security Architect (AI/Cloud)

Location: Stockholm, Sweden; hybrid with at least 2 days per week from the office

Company

hirify.global provides a workforce management SaaS platform for scheduling, staffing, and frontline workforce engagement across retail, hospitality, logistics, and healthcare.

What you will do

• Own day-to-day security across the product, cloud platform, and information security management system.
• Lead cloud and architecture security reviews, threat modelling, and validation across AWS and GCP environments, including IAM, networking, storage, databases, secrets, and logging.
• Embed security into CI/CD and application development through IaC scanning, SAST, DAST, SCA, secret scanning, and OWASP-based web and API reviews.
• Threat-model AI features, LLM integrations, agents, and connectors, maintaining requirements for prompt injection, data leakage, excessive agency, supply chain, and customer-data access.
• Own vulnerability management, detection engineering, incident response, and post-incident reviews across applications, infrastructure, and endpoints.
• Run ISO 27001 and SOC 2 programmes, coordinate audits, manage third-party risk and customer assurance, and maintain security evidence and the Trust Centre.

Requirements

• Several years of hands-on security experience in a multi-tenant SaaS company, covering cloud security engineering and GRC.
• Hands-on AWS or GCP experience and working knowledge of the other, including IAM, networking, workload security, KMS, and audit logging.
• Experience securing CI/CD pipelines, infrastructure as code with Terraform or CloudFormation, and containers; practical use of SAST, DAST, SCA, and secret-scanning tools.
• Knowledge of web and API security, OWASP ASVS and Top 10, and OAuth 2.0, SAML, and OIDC authentication and authorization protocols.
• Experience with AI and LLM security, including the OWASP Top 10 for LLM Applications, OWASP AI Exchange, LLM integrations, agents, connectors, prompt injection, data leakage, excessive agency, and supply-chain risks.
• Experience writing and tuning SIEM detections using MITRE ATT&CK, leading incidents, and writing post-incident reviews.
• Experience operating ISO 27001 and SOC 2 Type II controls, including evidence collection, auditor coordination, and formal risk-register management.
• Ability to read code and Terraform, automate with Python, Bash, or PowerShell, and analyze telemetry using SIEM queries or SQL.
• Ability to turn security findings into actionable engineering work and communicate risks clearly to leadership.

Nice to have

• Certifications such as CISSP, CCSP, CISM, CRISC, AWS Certified Security - Specialty, or ISO 27001 Lead Auditor.
• Experience with GRC platforms such as Vanta or Drata.
• Experience with GDPR from the data-processor side.
• Experience applying the EU AI Act to a SaaS product.

Culture & Benefits

• International, open, inclusive, and collaborative environment with opportunities to take ownership and make an impact.
• Flexible work hours and a hybrid setup requiring at least 2 office days per week.
• Enhanced vacation allowance, gym membership contribution, health insurance, and pension plan.
• On-market pay.

Hiring process

• Short application followed by psychometric and objective assessments through Alva Labs.
• Screening call with Talent, hiring-manager deep dive, and a role-specific technical case.
• Final in-office interview, followed by offer, references, and background checks.