Security Architect

BULLIT MANAGEMENT SERVICES LIMITED; Pohjois-Pohjanmaa; On-site; EUR 70,000 - 100,000; Full time

Job summary

BULLIT MANAGEMENT SERVICES LIMITED is seeking a Product Security Architect to review, validate, and refine threat models across applications, Linux platforms, REST APIs, and FPGA-based systems. You will assess build environments and production processes, identifying attack surfaces and trust boundaries to strengthen security across product ecosystems.

Responsibilities include updating security architecture documentation and providing remediation guidance to UI, platform, FPGA, and build/release

Qualifications

• Experience in threat modeling and product security architecture reviews.
• Strong knowledge of secure SDLC principles and secure-by-design practices.
• Experience assessing security across multiple product ecosystems and interfaces.

Responsibilities

• Review, validate, and refine product threat models using industry-standard methodologies (STRIDE, PASTA, Attack Trees).
• Perform comprehensive security assessments across application/UI software, Linux-based platforms, REST APIs, FPGA-integrated systems, and build/release environments.
• Identify attack surfaces and trust boundaries, and propose remediation strategies across standalone and integrated product ecosystems.
• Review and update security architecture documentation to reflect required controls; provide ongoing security guidance to engineering teams.

Skills

Threat modeling

AppSec

Product security architecture

Secure SDLC

Job description

• Review, validate, and refine product threat models using industry-standard methodologies (STRIDE, PASTA, Attack Trees, etc.).
• Perform comprehensive security assessments across:
• Application and UI software
• Linux-based platforms
• REST APIs and digital interfaces
• FPGA-integrated systems
• Build and release environments
• Production processes and customer-facing documentation
• Identify attack surfaces, trust boundaries, and security gaps across standalone and integrated product ecosystems.

Product Security Architecture

• Analyze product architectures against internal cybersecurity standards and industry best practices.
• Assess hardware and software trust boundaries, including:
• Secure Boot and hardware-rooted trust mechanisms
• Review cybersecurity aspects of multi-product solutions and interconnected systems.
• Evaluate container-based architectures, Linux security controls, and API security implementations.

Compliance & Security Governance

• Assess product readiness against EU Cyber Resilience Act (CRA) requirements.
• Create and validate Cryptographic Bill of Materials (CBOM).
• Identify compliance gaps and recommend remediation strategies.
• Update security architecture and design documentation to reflect required cybersecurity controls.
• Develop detailed action plans for remediation, categorized by engineering functions such as:
• UI/Application Development
• Platform Software
• FPGA Development
• Build & Release Teams
• Production/Manufacturing Teams
• Provide ongoing security consulting, design reviews, and implementation guidance.
• Review and approve security improvements implemented by development teams.

Key Skills:

• Threat Modeling
• Application Security (AppSec)
• Product Security Architecture Reviews
• Secure SDLC & Secure-by-Design