Principal Software Security Architect

BeyondTrust, Inc.; Ottawa; On-site; CAD 140,000 - 190,000; Full time

Job summary

BeyondTrust, Inc. seeks a Principal Software Security Architect to own the security architecture for its product suite end to end, embedding secure-by-default patterns from concept through production.

You will lead threat modeling, attack surface reduction, and secure design reviews across cloud-native systems and endpoints, using LLMs to scale analysis and remediation. The role sits within the Office of the CTO, reporting on security architecture strategy and contributing reference

Qualifications

• 10+ years hands-on software engineering and security architecture experience.
• Deep expertise in threat modeling and attack surface reduction at scale.
• Practical experience applying LLM platforms to security engineering work.

Responsibilities

• Own end-to-end security architecture for assigned product lines from concept to production.
• Lead threat modeling, attack surface analysis, and secure design reviews across products and cloud-native systems.
• Use LLM platforms to scale threat analysis, architecture review, and remediation guidance.

Skills

Software engineering

Security architecture

Threat modeling

Attack surface reduction

Code reading

Tools

LLM platforms (Claude/OpenAI)

Job description

• The Principal Software Security Architect owns security architecture for BeyondTrust's product suite end to end, including endpoint agents, thick clients, SaaS platforms, APIs, identity systems, and cloud-native services
• This is an engineering leadership role embedded within Engineering and Architecture teams in the Office of the CTO, accountable for designing security into products from first principles through to what ships and runs in production, rather than reviewing other teams' work from the outside
• We operate AI-first: Claude and LLM-driven workflows are how the team performs threat modeling, secure design reviews, vulnerability analysis, and developer enablement today, and this role is expected to operate at that level from day one and help extend that practice further
• Own end-to-end security architecture for assigned product lines, from concept through production, defining the target-state architecture and secure-by-default patterns each product builds on
• Lead threat modeling, attack surface analysis, and secure design reviews across products, platform services, endpoint agents, and cloud-native systems, driving the architectural decisions that eliminate unnecessary exposure rather than just documenting risk
• Use LLM platforms (Claude, OpenAI) as core tools to scale threat analysis, abuse-case generation, architecture review, and remediation guidance, building the prompts, plugins, skills, and agent workflows that make the engineering org faster and more consistent
• Embed secure-by-default patterns directly into product development, contributing reference architectures, reusable components, and automated guardrails, and building self-service security capabilities that let engineers make secure decisions without a bottleneck
• Own and expand the Product Security handbook, a living system that feeds the team's AI workflows to enforce secure design standards, architecture guidance, and engineering best practices
• Set technical direction for secure design across the org as a principal-level engineer, mentoring engineers, architects, and Security Champions on secure design, attack surface reduction, and AI-first security workflows
• Help evolve BeyondTrust's AI-first Product Security Architecture strategy, identifying where AI workflows can replace manual processes, where they need human oversight, and where the next capability gaps are
• What Success Looks Like:
• Measurable reduction in product attack surface and recurring architecture risks, measured by risk eliminated, not findings produced
• Security architecture for owned product lines is defined, documented, and demonstrably adopted in shipping products
• Increased scale and consistency of secure design reviews through AI-first workflows
• Faster identification and remediation of design-level and architecture-level risks
• Engineering teams actively using self-service security capabilities that have been built
• Expansion of AI-first Product Security Architecture capabilities across the SDLC

The ideal candidate brings 10+ years of hands-on software engineering and security architecture experience, deep expertise in threat modeling and attack surface reduction at scale, and practical experience applying LLM platforms to security engineering workAbility to influence engineering and product teams from within, acting as a persuasive, credible, and practical partner rather than a gatekeeperDeep, practical experience with threat modeling, attack surface analysis, secure design reviews, and architecture risk analysis at scale, not just in theoryStrong hands-on engineering background, with the ability to read and contribute to the codebase, design systems, and earn credibility with senior engineers as a peerStrong understanding of cloud-native systems, APIs, endpoint agents, thick clients, and identity/security platformsExperience building AI-native security workflows, plugins, agents, or developer toolingHands-on experience using LLM platforms (Claude, OpenAI, or similar) in engineering or security workflowsBuilder mindset, having created scalable security workflows, frameworks, or enablement programs, not just consumed them10+ years in Software Engineering, Security Architecture, Product Security, or Application Security, with a track record of owning architecture for shipping productsOffensive security experience or adversarial testing backgroundBackground in securing endpoint technologies, identity systems, or enterprise security platformsCloud security experience across AWS, Azure, or Kubernetes environments