Security Architect

At WHOOP, we're on a mission to unlock and inspire performance for life. Our wearable technology provides personalized insights that help millions of members better understand their bodies, and make smarter decisions about training, recovery, and lifestyle.

WHOOP is seeking a hands-on Security Architect to help strengthen and scale security architecture across our technology environment. This role is an opportunity for an experienced security engineer or architect to expand their impact by shaping secure design practices, solving complex technical challenges, and helping engineering teams build secure systems at scale.

The ideal candidate brings strong technical experience in cloud security or application security, with demonstrated experience evaluating system architectures and making sound security design decisions. You don't need to have held the title of Security Architect or previously built an enterprise architecture program, but you should have the technical depth, judgment, and curiosity to identify architectural risks and develop practical solutions.

WHOOP operates a modern technology environment spanning cloud platforms, applications, and enterprise systems. As AI-assisted development accelerates how software is built, our approach to security architecture must evolve as well. We're looking for someone who can help move security beyond manual reviews by establishing reusable security patterns, integrating automated controls, and making secure design easier for engineering teams to adopt.

Working closely with the Security Architecture Lead, Product Security, Platform Engineering, Software Engineering, IT, and the broader Information Security organization, you'll contribute to the evolution of Security Architecture as an enterprise capability while remaining deeply engaged in hands-on technical work.

Responsibilities

• Conduct security architecture reviews across cloud platforms, applications, infrastructure, identity systems, and enterprise technologies, identifying security risks and recommending practical mitigations.

• Partner with Engineering, Product Security, Platform, and IT teams to incorporate security into system design, development, infrastructure provisioning, and deployment workflows.

• Perform threat modeling and security design assessments for Web and Mobile applications, APIs, cloud services, third-party integrations, and new technologies, identifying attack paths, trust boundaries, and sensitive data flows.

• Evaluate security controls across cloud and application environments, including IAM, workload identities, authentication, authorization, network segmentation, secrets management, encryption, and data protection.

• Develop and promote secure-by-default architecture patterns, reference designs, and reusable security controls that enable engineering teams to implement consistent security practices.

• Help translate security architecture requirements into automated guardrails, policy-as-code, and scalable security checks integrated into engineering and deployment workflows.

• Collaborate with Engineering teams to identify opportunities to reduce repetitive manual security reviews through standardized designs, preventive controls, and risk-based review approaches.

• Assess the security implications of AI-assisted software development, AI-enabled applications, and emerging agentic technologies, including access to sensitive data, tool integrations, identities, and permissions.

• Apply automation and AI-assisted analysis where appropriate to improve the efficiency and consistency of architecture assessments and threat modeling, while maintaining appropriate human oversight.

• Review findings from penetration tests, vulnerability assessments, cloud security monitoring, and incidents to identify systemic architectural weaknesses and recommend sustainable improvements.

• Provide technical security guidance on new technologies, strategic integrations, and architectural changes, balancing security requirements with performance, scalability, and business needs.

• Help translate applicable security policies and regulatory requirements into practical technical architecture controls.

• Document architecture assessments, technical recommendations, security patterns, and design decisions in a clear, actionable format.

• Partner with the Security Architecture Lead to strengthen architecture standards, improve review practices, and expand the adoption of scalable security controls across WHOOP.

Qualifications

• 7+ years of experience in cloud security, application security, or security architecture, with demonstrated experience designing or evaluating secure systems.

• Strong technical expertise in cloud or application security architecture, with a solid understanding of identity, infrastructure, and modern software development practices.

• Experience conducting security architecture reviews, threat modeling, and technical risk assessments for complex systems.

• Ability to independently identify architectural risks, evaluate design tradeoffs, and recommend practical, scalable security solutions.

• Experience developing or implementing security controls, automation, or secure engineering practices within modern technology environments.

• Ability to evaluate system designs, technical documentation, and implementation approaches to identify security weaknesses.

• Strong communication and collaboration skills, with the ability to influence technical decisions and work effectively across engineering and security teams.

Preferred Qualifications

• Hands-on software development, cloud engineering, or infrastructure engineering experience.

• Experience with secure-by-default architecture patterns, policy-as-code, or automated security controls.

• Familiarity with AI-assisted development, AI-enabled applications, or emerging agentic technologies and their security implications.

• Experience working across multiple security domains or contributing to enterprise security architecture initiatives.

• Familiarity with relevant security or regulatory frameworks (NIST, ISO 27001, SOC 2, HIPAA, PCI DSS) or professional security certifications.

This role is based in the WHOOP office located in Boston, MA. The successful candidate must be prepared to relocate if necessary to work out of the Boston, MA office.

Interested in the role, but don’t meet every qualification? We encourage you to still apply! At WHOOP, we believe there is much more to a candidate than what is written on paper, and we value character as much as experience. As we continue to build a diverse and inclusive environment, we encourage anyone who is interested in this role to apply.

WHOOP is an Equal Opportunity Employer and participates in E-verify to determine employment eligibility

The WHOOP compensation philosophy is designed to attract, motivate, and retain exceptional talent by offering competitive base salaries, meaningful equity, and consistent pay practices that reflect our mission and core values.

At WHOOP, we view total compensation as the combination of base salary, equity, and benefits, with equity serving as a key differentiator that aligns our employees with the long-term success of the company and allows every member of our corporate team to own part of WHOOP and share in the company’s long-term growth and success.

The U.S. base salary range for this full-time position is $155,000 - $195,000. Salary ranges are determined by role, level, and location. Within each range, individual pay is based on factors such as job-related skills, experience, performance, and relevant education or training.

In addition to the base salary, the successful candidate will also receive benefits and a generous equity package.

…