Senior Threat Modeler: Cloud, API & Secure Architecture

State Street; Devon (PA); Hybrid; USD 120,000 - 202,500; Full time

Job summary

State Street is seeking a Senior Threat Modeler to perform threat modeling across enterprise applications, cloud platforms, APIs, and emerging technologies to identify security risks early in the development lifecycle and drive secure-by-design outcomes.

The role involves partnering with architects, engineers, developers, and cybersecurity teams to strengthen the security posture of critical business systems and technology platforms.

Qualifications

• Degree in Computer Science, Cybersecurity, Information Technology, Engineering, or a related discipline.
• 12 years or more of experience in application security, cloud security, cybersecurity architecture, threat modeling, or related disciplines, with at least 7 years of hands-on cybersecurity experience preferred.
• Demonstrated experience conducting threat modeling exercises for enterprise applications, APIs, cloud platforms, and distributed systems.
• Strong expertise in application security principles, secure software development lifecycles, OWASP Top 10, API security, and secure coding practices.
• Experience assessing and securing cloud environments across AWS, Azure, and/or Google Cloud Platform.
• Knowledge of microservices, containers, Kubernetes, CI/CD pipelines, DevSecOps practices, and modern software architectures.
• Experience with threat modeling methodologies such as STRIDE, MITRE ATT&CK, attack trees, and adversary-based risk analysis.
• Professional certifications such as CISSP, CCSP, CSSLP, GWAPT, GWEB, AWS Security Specialty, Azure Security Engineer, or equivalent security certifications are highly desirable.
• Experience within financial services or other highly regulated industries is preferred.

Responsibilities

• Conduct threat modeling activities for business applications, cloud-native platforms, APIs, and strategic technology initiatives.
• Analyze application architectures, data flows, trust boundaries, and cloud deployments to identify security threats and design weaknesses.
• Partner with application development, cloud engineering, and security teams to recommend practical risk mitigation strategies and secure design improvements.
• Perform security assessments using established methodologies such as STRIDE, MITRE ATT&CK, attack trees, and risk-based analysis techniques.
• Contribute to the development of threat modeling standards, reusable patterns, training materials, and secure-by-design practices across the enterprise.
• Possess strong knowledge of cloud-native architectures and security controls across AWS, Azure, and Google Cloud, with the ability to identify and mitigate risks in distributed, containerized, and platform-based environments.

Skills

Threat modeling

Cloud security

Application security

Risk assessment

Security architecture

Stakeholder influence

DevSecOps

Education

Degree in Computer Science, Cybersecurity, Information Technology, Engineering

Tools

Kubernetes

CI/CD

Job description

State Street is seeking a Senior Threat Modeler to perform threat modeling across enterprise applications, cloud platforms, APIs, and emerging technologies to identify security risks early in the development lifecycle and drive secure-by-design outcomes.

The role involves partnering with architects, engineers, developers, and cybersecurity teams to strengthen the security posture of critical business systems and technology platforms.