Senior Software Security Architect - Cloud & Threat Modelling

Quiet Capital; Greater London; On-site; GBP 120,000 - 180,000; Full time

Job summary

Nothing, a London-based technology company, is seeking an experienced application security leader to own the security lifecycle for our backend services and cloud platforms. You will define secure development standards and guide teams to build defensible architectures without slowing delivery.

Lead threat modelling across authentication, data protection and public interfaces, implement SAST/DAST/SBOM tooling, and drive encryption and runtime defenses.

Qualifications

• 6+ years in application security, including security architecture for commercial products/services.
• Deep threat modelling expertise and ability to define methodologies.
• Hands-on cloud security across AWS, GCP, Azure and other hyperscalers.
• Secure SDLC mastery: SAST, DAST, SBOM.
• Experience applying AI/LLMs to security: simulating threats and building countermeasures.
• Strong cryptography and identity fundamentals: TLS, OAuth 2.0, SSO, token management.
• Proven ability to own a domain end to end and cut through ambiguity.

Responsibilities

• Own security lifecycle and secure architecture for backend services and cloud platforms.
• Define secure development standards and wire SAST, DAST and SBOM tooling into shipping.
• Own vulnerability management end to end: triage and drive closure.
• Design security testing from pentesting to fuzzing and build reusable tools.
• Ship network and data protection: API security, WAF, encryption in transit/rest.
• Collaborate with mobile/os/desktop teams on client-side security tactics.
• Partner with privacy/legal to address global regulatory requirements including AI.
• Lead threat modelling across authentication, data protection and input handling.

Skills

Security architecture

Threat modelling

Cloud security

Secure SDLC

AI/LLM security

Cryptography & identity

Production code (Python/Go/Java/C++)

Tools

AWS

GCP

Azure

Job description

Nothing, a London-based technology company, is seeking an experienced application security leader to own the security lifecycle for our backend services and cloud platforms. You will define secure development standards and guide teams to build defensible architectures without slowing delivery.

Lead threat modelling across authentication, data protection and public interfaces, implement SAST/DAST/SBOM tooling, and drive encryption and runtime defenses.