Architect Product Security

JetBlue; New York (NY); Sur place; USD 106 000 - 150 000; Plein temps

Résumé du poste

JetBlue seeks an Architect, Product Security to integrate secure-by-design principles into product development. You will guide teams on security architecture, threat modeling, and safe coding throughout the SDLC, enabling resilient digital services.

You will embed security in CI/CD, collaborate with Product Managers, Engineers, and Cloud teams, and lead security testing initiatives across applications, APIs, and platforms.

Qualifications

• Bachelor's Degree in a relevant field or equivalent experience (4+ years).
• 4+ years in application security, product security, or security architecture.
• Experience securing cloud-native systems, APIs, and microservices.
• Experience securing modern applications and distributed platforms.
• Ability to work in fast-paced product and engineering environments.
• Willingness to travel occasionally (10%).
• Authorized to work in the US; no visa sponsorship expected.

Responsabilités

• Define and implement security architecture patterns for applications, APIs, cloud services, and platforms.
• Develop secure design standards, reference architectures, and reusable patterns.
• Ensure alignment with enterprise security strategy.
• Embed security controls into CI/CD pipelines and developer workflows.
• Define secure coding practices and product security requirements.
• Automate security testing and validation (SAST, DAST, SCA).
• Conduct threat modeling sessions across product teams.
• Identify risks and define practical mitigation strategies.
• Translate risk posture into product-level decisions and tradeoffs.
• Guide application security testing strategies and remediation.

Connaissances

Security architecture

Threat modeling

Secure coding practices

DevSecOps

Automation of security testing

Cross-functional collaboration

Product security guidance

Fast-paced environments

Formation

Bachelor's Degree

Outils

AWS

Azure

GCP

Kubernetes

CI/CD tooling

WAF/ Secrets management

SAST/DAST/SCA tools

Description du poste

Position Summary

The Architect, Product Security partners with product and engineering teams to design and deliver secure applications, APIs, and digital services. This role embeds security into product design and development by providing hands-on guidance, conducting threat modelling, and helping teams implement secure-by-design practices across the SDLC. The Architect operates as a hands-on security partner to product teams. The role focuses on secure-by-design principles, practical risk reduction, and enabling delivery teams to build resilient, scalable, and secure products without unnecessary friction.

Essential Responsibilities

• Define and implement security architecture patterns for applications, APIs, cloud services, and platforms
• Develop secure design standards, reference architectures, and reusable patterns
• Ensure alignment with enterprise architecture and security strategy
• Embed security controls into Continuous Integration/Continuous Deployment pipelines and developer workflows
• Define and enforce secure coding practices and product security requirements
• Enable automation of security testing and validation ( Static Application Security Testing, Dynamic Application Security Testing, Secure Code Analysis )
• Conduct and facilitate threat modeling sessions across product teams
• Identify architectural risks and define practical mitigation strategies
• Translate enterprise risk posture into product-level decisions and tradeoffs
• Define and guide application security testing strategies
• Partner with engineering teams to prioritize and remediate vulnerabilities
• Support penetration testing and security validation activities
• Architect controls for Authentication, Data protection and service security
• Support adoption of Zero Trust principles
• Partner with: Product Managers, Software Engineers, Platform and Cloud teams
• Other duties as assigned

Minimum Experience and Qualifications

• Bachelor's Degree in a relevant field; OR demonstrated capability to perform job responsibilities with a High School Diploma/GED and at least four (4) years of previous relevant work experience
• Four (4) years of experience in Application security, product security, or security architecture
• Experience designing and securing: Cloud-native and distributed systems, and APIs and microservices architectures
• Experience designing or securing modern applications, APIs, cloud services, distributed systems, or digital platforms
• Strong ability to operate in fast-paced product and engineering environments
• Ability to manage multiple priorities in a fast-paced, multi-team environment
• Available for occasional overnight travel (10%)
• Must pass a pre-employment drug test
• Must be legally eligible to work in the country in which the position is located
• Authorization to work in the US is required, this position is not eligible for visa sponsorship

Preferred Experience and Qualifications

• Experience supporting customer-facing applications, digital platforms, mobile applications, ecommerce, loyalty, APIs, or cloud-native services.
• Experience in aviation, transportation, financial services, or another regulated or operationally complex environment.
• Familiarity with AWS, Azure, GCP, Kubernetes, containers, serverless platforms, API gateways, WAF technologies, secrets management, and CI/CD tooling.
• Experience with SAST, DAST, SCA, or application security posture management tools.
• Knowledge of OWASP Top 10, OWASP API Security Top 10, OWASP ASVS, NIST Cybersecurity Framework, NIST 800-53, NIST 800-63, CIS Benchmarks, ISO 27001, or similar frameworks.
• Experience contributing to secure design standards, architecture patterns, product security checklists, or developer security guidance.
• CISSP, CSSLP, CCSP, AWS Security Specialty, Azure Security Engineer, or equivalent certification preferred.

Crewmember Expectations:

• Regular attendance and punctuality
• Potential need to work flexible hours and be available to respond on short-notice
• Able to maintain a professional appearance
• When working or traveling on JetBlue flights, and if time permits, all capable crewmembers are asked to assist with light cleaning of the aircraft
• Must be an appropriate organizational fit for the JetBlue culture, that is, exhibit the JetBlue values of Safety, Caring, Integrity, Passion and Fun
• Promote JetBlue's #1 value of safety as a Safety Ambassador, supporting JetBlue's Safety Management System (SMS) components, Safety Policy and behavioral standards
• Identify safety and security concerns, issues, incidents or hazards that should be reported and report them whenever possible and by any means necessary including JetBlue's confidential reporting systems (Aviation Safety Action Program (ASAP) or Safety Action Report (SAR))
• The use of ChatGPT or any other automated tool during the interview process will disqualify a candidate from being considered for the position.

Equipment:

• Computer and other office equipment

Work Environment:

• Traditional office environment

Physical Effort:

• Generally not required, or up to 10 pounds occasionally, 0 pounds frequently. (Sedentary)

Compensation:

• The base pay range for this position is between $105,600.00 and $150,400.00 per year. Base pay is one component of JetBlue's total compensation package, which may also include access to healthcare benefits, a 401(k) plan and company match, crewmember stock purchase plan, short-term and long-term disability coverage, basic life insurance, free space available travel on JetBlue, and more.