Manager, Product Security & Architecture

Solifi; Minneapolis (MN); On-site; USD 140,000 - 200,000; Full time

Benefits offered by this job

Medical, Dental, Vision

Flexible Spend Account (FSA)

Health Savings Account (HSA)

Life and AD&D Insurance

Disability Insurance

Employee Assistance Program (EAP)

401K

Job summary

Solifi Group in Minneapolis seeks a Manager, Product Security & Architecture to define and lead a new security function. You will personally run threat models and architecture reviews while building a team, setting standards, and embedding secure design across engineering.

This role covers AI security, secure SDLC, and cross-functional collaboration across multiple regions. The ideal candidate has 8+ years in security roles, hands-on capability, and experience scaling security practices in a

Qualifications

• 8+ years in application security, product security or security architecture.
• Experience establishing threat modelling as a routine in delivery.
• Ability to instill secure by design across engineering teams.

Responsibilities

• Define and build the security function, size, and engagement with engineering.
• Lead threat models and architecture reviews for high-risk work.
• Implement secure SDLC gates and governance with a security champions network.
• Define reusable guardrails and patterns to make secure design the easy option.
• Develop threat modelling coverage strategy across product portfolio.
• Oversee application security tooling strategy including SAST/DAST/SCA in CI/CD.
• Lead AI security review for models, data handling, prompts, and risks.
• Collaborate with Engineering leadership across geographies and with Audit/Client security work.
• Measure and scale the function with product complexity and risk.

Skills

Threat modelling

Application security tooling

Security architecture

Lead security reviews

People management

AI security review

Security champions network

Cloud architecture

Education

Bachelor's Degree

Tools

SAST

DAST

SCA

Job description

Vacancy Name Manager, Product Security & ArchitectureVacancy No VN1060Job Title Manager, Product Security & ArchitectureWork Location City MinneapolisAbout Solifi Solifi deliver a solid financial technology foundation for equipment, working capital, wholesale, and automotive finance firms. At Solifi, we believe that commerce is only as strong as the system it runs on. Our mission is to reshape finance technology by bringing together proven solutions into a singular powerful technology platform designed to help protect and scale financial organizations. We guard our customers by being precise and reliable, we guide their success by combining powerful technology with proven expertise, and we help them grow by unleashing their potential.About the TeamThe Manager, Product Security & Architecture leads a team of security architects and product security engineers responsible for ensuring Solifi's applications, platforms, and AI capabilities are secure by design. The Manager, Product Security & Architecture will be working cross-functionally with Engineering, Product, Architecture, and Cybersecurity teams.About the Position Solifi delivers secured finance software across asset and equipment finance, automotive and fleet, wholesale and floorplan, and working capital and invoice finance. Our products run as cloud services on the Solifi Open Finance Platform and, for some clients, as deployments the client hosts themselves. Security is designed into that portfolio today through our secure SDLC, our architecture and pen testing programmes, and the security work embedded in our engineering teams.As the portfolio and our AI capability grow, we are investing in a dedicated Product Security & Architecture function to bring that work together under single ownership and scale it deliberately. Its purpose is to make secure by design the default in how Solifi builds software: security decisions taken at design time, by the engineers closest to the product, with our specialists raising the standard rather than acting as the only line of defence.This is a build role. The team does not exist yet in its target form, and you will be defining it: the operating model, the roles, the coverage strategy, and the case for the investment behind it.It is also a player/coach role. With a team of this size, and particularly while you are still building it, you will be doing the work as well as leading it: running threat models yourself, sitting in design reviews, and staying close enough to the technical detail to set standards you have applied in practice. The balance shifts toward coaching as the team comes together, but it never becomes purely a management job.Role and Responsibilities What you will own:• Defining and building the function. Shaping the operating model and the team, writing the roles, hiring into them, and setting how the function engages with engineering. Target size is approximately four, expected to include a security architect and product security engineers, but the final shape is yours to propose.• The scope of the function end to end: threat modelling, application security tooling, security architecture review, secure SDLC gates, the security champions network, and security review of AI features.• Hands-on delivery alongside the team. Personally leading threat models and architecture reviews on the higher-risk or more novel work, carrying a share of the queue while the team is still forming, and coaching through doing rather than through direction alone.• Instilling secure by design practice across engineering. Setting the standards, patterns and reusable guardrails that make the secure option the easy one, growing the security champions network, and building engineers' capability so that secure design judgement sits with the delivery teams rather than depending on review. Your team should be raising the ceiling, not becoming a bottleneck.• Threat modelling coverage strategy across a portfolio of distinct products, including how coverage is divided across the team and rebalanced as products evolve, migrate to OFP, or are added through acquisition.• Application security tooling strategy, commercially as well as technically. Static and dynamic analysis, software composition analysis, secret scanning and similar, integrated into CI/CD pipelines. You own selection, consolidation, budget and vendor relationships.• AI security, in both directions. Reviewing AI capability going into Solifi products: model use, data handling, prompt and output risk, agentic tooling, and the classification, transparency and human oversight questions raised by the EU AI Act and comparable regimes emerging in the other markets we serve. And building the case for AI-assisted security review as a way to scale coverage with release volume rather than headcount, including where its output can be relied on and where a human gate stays mandatory. Making that investment case is part of the job, not a given.• The relationship with Engineering leadership. Securing threat modelling time inside delivery plans and agreeing remediation capacity, working with teams and stakeholders across the UK, North America, India and Serbia.• Client-facing and audit-facing security work where secure development is in scope: client security assessments and questionnaires, the application pen testing programme and its remediation, and the secure SDLC evidence supporting SOC 2, ISO 27001 and NIST CSF.You will also work closely with our Vulnerability Operations team on application-layer findings and with Security Engineering on cloud and platform design. Sizing and measuring this function against product complexity and risk surface rather than developer headcount is a position you will need to hold and evidence.What success looks like in your first year• The function is defined, staffed and operating, with clear ownership for every activity in scope and named coverage for every product line.• Threat model review is an established, expected step for new products and features ahead of release.• Security architecture review has a published SLA and consistently meets it, and engineering teams engage the function early because it is the quickest route to a design that ships.• Automated and AI-assisted review coverage across releases is measured, improving, and independent of developer count.• Application-layer findings from pen tests and client assessments close faster, with recurring themes addressed at the design level rather than fixed repeatedly downstream.• Secure by design is visibly taking hold: security champions active across the engineering geographies, documented patterns and guardrails in use, and delivery teams making sound security calls at design time without waiting on review.• A funded, evidenced investment plan for the function's next stage.About YouEssential: • 8+ years in application security, product security or security architecture. • You have owned application security tooling: selected it, rolled it out across engineering teams, and made the findings get fixed. • You have established threat modelling as a routine part of a delivery process in an organisation that was not doing it before. • A track record of instilling secure by design practice in engineering teams through standards, patterns, champions and enablement, so that security capability grows inside delivery rather than sitting solely with the security team. • You can hold a technical position with senior engineering leaders and reach a workable agreement. • People management experience, or clear and evidenced readiness to build and manage a small team including principal-level ICs. • Current hands-on capability, and genuine willingness to use it. You can lead a threat model or an architecture review yourself, to a standard your team will learn from, and you want a role where that stays part of the job. • Comfortable building something from a standing start, with the judgement to sequence it rather than attempt everything at once. Valuable: • Experience managing a hybrid team and stakeholders across multiple geographies and time zones. • Fintech, financial services, or regulated multi-product SaaS. Bonus if you have worked across both modern cloud services and client-hosted deployments, because we have both. • Hands-on AI and LLM feature security review, and a considered view on where AI-assisted security review is and is not trustworthy. • Working knowledge of DORA and the EU AI Act, or comparable regimes elsewhere, and how they land on product development. • Experience representing security to clients, auditors or prospects. • CISSP, OSCP, CCSP or equivalent. A technical degree is welcome, practical track record matters more. • Exposure to M&A or due diligence work, from either side.Preferred Experience Level 8 yearsPreferred Education Level Bachelor's DegreeEmployment Basis Full TimeBenefits Medical, Dental, Vision, Flexible Spend Account (FSA), Health Savings Account (HSA), Life and Accidental Death & Dismemberment (AD&D) Insurance Coverage, Disability Insurance Coverage (Short Term and Long Term), Employee Assistance Program (EAP), 401K Tax Deferred Retirement Savings PlanApplications Close Date 09 Mar 2027