Security Architect

Quinyx is looking for a senior Security Architect to own security day to day across our product, our cloud platform and our information security management system (ISMS). You set the security requirements, review what Engineering and Platform build, run our ISO 27001 and SOC 2 programmes and follow findings through to closure. You report to the CIO and work with Engineering, Platform, SRE, IT and Legal. Security at Quinyx owns assessment, requirements, validation and follow-through.

This is a hands-on individual contributor role that bridges cloud security engineering and continuous assurance. You work directly in cloud environments, containerized workloads, CI/CD pipelines and identity architecture, and you own the ISMS that proves the controls work.

• Cloud and architecture security. Run security architecture reviews and threat modelling for product and infrastructure changes. Assess our AWS and GCP environments across IAM, networking, storage, databases, secrets and logging. Set the requirements and validate what Platform and SRE build.
• SDLC and application security. Embed security into CI/CD: IaC scanning, SAST, DAST, SCA and secret scanning. Review web and API security against OWASP ASVS and the Top 10, including authentication and authorisation (OAuth 2.0, SAML, OIDC).
• AI security. Threat-model and review AI features, LLM integrations, agents and connectors in our product and internal tooling against the OWASP Top 10 for LLM Applications and the OWASP AI Exchange. Maintain the security requirements in our AI Building Policy and check that builders follow them, covering prompt injection, data leakage, excessive agency, model and tool supply chain, and access to customer data.
• Vulnerability management. Own the process end to end across applications, cloud infrastructure and endpoints. Prioritise by attack path and asset context, and track pentest findings and risk exceptions through to verified closure.
• Detection and incident response. Define the security telemetry we collect, tune SIEM detections against MITRE ATT&CK techniques, and lead incident triage, containment and post-incident reviews.
• ISMS and audits. Run the ISMS for ISO 27001 and SOC 2 day to day. Keep policies, the Statement of Applicability and the risk register current. Coordinate internal and external audits, collect evidence and automate control monitoring in our GRC platform.
• Vendor and customer assurance. Assess third-party risk before we onboard a vendor and at renewal. Answer customer security questionnaires and assurance reviews with accurate, reusable evidence and keep our Trust Centre current.

• Several years of hands-on security work in a multi-tenant SaaS company, covering cloud security engineering and GRC.
• Hands-on experience with AWS or GCP and working knowledge of the other: IAM, networking, workload security, KMS and audit logging.
• Securing CI/CD pipelines, infrastructure as code (Terraform or CloudFormation) and containers, with practical use of SAST, DAST, SCA and secret scanning tools.
• Web and API security: OWASP ASVS and Top 10, and authentication and authorisation protocols (OAuth 2.0, SAML, OIDC).
• AI and LLM security: the OWASP Top 10 for LLM Applications and the OWASP AI Exchange, and practical experience with the risks of LLM integrations, agents and connectors (prompt injection, data leakage, excessive agency, supply chain).
• Detection engineering: writing and tuning SIEM detections with MITRE ATT&CK as the reference.
• Operating ISO 27001 and SOC 2 Type II controls: evidence collection, auditor coordination and a formal risk register.
• Reads code and Terraform, writes automation in Python, Bash or PowerShell, and analyses telemetry with SIEM queries or SQL.
• Has led incidents and written the post-incident review.
• Turns a security finding into an action an engineer will take, and a risk into a sentence a leadership team will act on.
• Certifications such as CISSP, CCSP, CISM, CRISC, AWS Certified Security - Specialty or ISO 27001 Lead Auditor.
• Experience with a GRC platform such as Vanta or Drata.
• Experience with GDPR from the data processor side.
• Experience applying the EU AI Act to a SaaS product.

💡 Desired personality traits

• Pragmatic risk judgement. You judge risk by material exposure and real exploitability, and you can explain why a critical tool score is a medium for us.
• Ownership. You follow findings and risk exceptions through to verified closure.
• Clear communication. You translate security concepts into practical actions for engineers, product teams and senior leadership.

Quinyx is a leading workforce management platform, helping businesses simplify scheduling, optimize staffing, and engage their frontline teams. We empower organizations across the globe, ranging from retail and hospitality to logistics and healthcare, with smart, mobile-first solutions. Here, you’ll find:

• A truly international team with colleagues from all over the world
• A flexible and hybrid-friendly work culture
• Opportunities to grow, take ownership, and make a real impact
• An open, inclusive, and fun environment where your ideas matter
• Flexible work hours and a hybrid setup with at least 2 days per week from the office.
• Enhanced vacation allowance, gym membership contribution, health insurance, and a pension plan.
• On-market pay.

📬 How to apply & Our process

Ready to join the team? Submit your application below, and we’ll be in touch as soon as possible. What our hiring process looks like:

• Fill out a short application.
• Complete our psychometric and objective assessments through Alva Labs.
• Screening call with our Talent team.
• Meet the hiring manager (Deep Dive).
• Complete a role-specific technical case.
• Final interview (in-office).
• Offer, references & background checks.

🙌 Quinyx is an equal opportunity employer

We celebrate diversity and are committed to creating an inclusive environment for all employees - no matter your background, identity, or experience.

When work just works!