Senior Staff Product Security Architect (Hybrid)

The Chan Zuckerberg Initiative, LLC; Redwood City (CA); Hybrid; USD 214,000 - 240,000; Full time

Benefits offered by this job

401(k) match

Paid time off to volunteer

Relocation support

Job summary

The Chan Zuckerberg Initiative is seeking a Senior Staff Product Security Architect to advance application security across Biohub and Learning Commons. You will partner with engineers, product managers, and security professionals to build secure foundations for large teams and scalable platforms.

Your work will shape security for research, data science, and education initiatives, ensuring zero trust and defense-in-depth across cloud-native and hybrid environments.

Qualifications

• 5+ years of experience in application security or security architecture, including leading cross-functional technical programs.
• Proficiency with secure SDLC processes and best practices for integrating security throughout the software development lifecycle.
• Hands-on experience designing and managing security controls within CI/CD pipelines, using automation frameworks to enable secure code delivery and rapid remediation.
• Familiarity with threat modeling, static and dynamic application security testing (SAST/DAST), and software composition analysis (SCA) tools.
• Deep understanding of DevSecOps principles, security automation, and infrastructure-as-code security.
• Knowledge of container security (Docker, Kubernetes), microservices architectures, and cloud platform security (AWS, Azure, GCP).
• Experience leading end-to-end security architecture design and governance across complex, cloud-native, and hybrid enterprise environments, aligning security capabilities to business and risk objectives.
• Proven ability to define and maintain reference architectures, security patterns, and control standards spanning network, identity, data protection, and application security domains.
• Skilled in conducting architecture risk assessments and design reviews, ensuring new and existing solutions meet zero trust, defense-in-depth, and compliance requirements in regulated industries.

Responsibilities

• Conceive, design, develop, and improve industry-leading security tooling, automation, architecture, and/or frameworks that enable enterprise teams at scale to deliver applications and services with appropriate security controls to meet evolving requirements for security and privacy.
• Identify and eliminate classes of security problems by shifting detection and prevention left into the development workflow.
• Provide just-in-time, actionable, technical security guidance to enterprise application and service teams.
• Ensure prioritization, resourcing, and timely delivery of work within a changing business environment.
• Collaborate with cross-functional teams to ensure security work is being prioritized and addressed.
• Drive end-to-end execution of technical security projects, including requirements gathering, scoping, status updates, and delivery milestones.
• Establish and report metrics to track compliance, program health, and ongoing risk posture.
• Coordinate with third-party vendors and auditors to augment internal security capabilities.
• Serve as a subject matter expert on infrastructure, architecture, and application security, offering guidance to technical and non-technical stakeholders.
• Support security reviews, threat modeling, and incident response efforts for applications and production infrastructure.

Skills

Security architecture

CI/CD security

Threat modeling

SAST/DAST/SCA

DevSecOps

Cloud security

Docker

Kubernetes

Architecture governance

Zero trust

Tools

Docker

Kubernetes

Job description

The Chan Zuckerberg Initiative is seeking a Senior Staff Product Security Architect to advance application security across Biohub and Learning Commons. You will partner with engineers, product managers, and security professionals to build secure foundations for large teams and scalable platforms.

Your work will shape security for research, data science, and education initiatives, ensuring zero trust and defense-in-depth across cloud-native and hybrid environments.