Senior Security Architect

Quinyx is looking for a senior Security Architect to own security day to day across our product, our cloud platform and our

information security management system (ISMS). You set the security requirements, review what Engineering and Platform build, run

our ISO 27001 and SOC 2 programmes and follow findings through to closure. You report to the CIO and work with Engineering,

Platform, SRE, IT and Legal. Security at Quinyx owns assessment, requirements, validation and follow-through.

This is a hands-on individual contributor role that bridges cloud security engineering and continuous assurance. You work directly

in cloud environments, containerized workloads, CI/CD pipelines and identity architecture, and you own the ISMS that proves the

controls work.

• Cloud and architecture security. Run security architecture reviews and threat modelling for product and infrastructure changes.

Assess our AWS and GCP environments across IAM, networking, storage, databases, secrets and logging. Set the requirements and

validate what Platform and SRE build.

• SDLC and application security. Embed security into CI/CD: IaC scanning, SAST, DAST, SCA and secret scanning. Review web and API

security against OWASP ASVS and the Top 10, including authentication and authorisation (OAuth 2.0, SAML, OIDC).

• AI security. Threat-model and review AI features, LLM integrations, agents and connectors in our product and internal tooling

against the OWASP Top 10 for LLM Applications and the OWASP AI Exchange. Maintain the security requirements in our AI Building

Policy and check that builders follow them, covering prompt injection, data leakage, excessive agency, model and tool supply

chain, and access to customer data.

• Vulnerability management. Own the process end to end across applications, cloud infrastructure and endpoints. Prioritise by

attack path and asset context, and track pentest findings and risk exceptions through to verified closure.

• Detection and incident response. Define the security telemetry we collect, tune SIEM detections against MITRE ATT&CK

techniques, and lead incident triage, containment and post-incident reviews.

• ISMS and audits. Run the ISMS for ISO 27001 and SOC 2 day to day. Keep policies, the Statement of Applicability and the risk

register current. Coordinate internal and external audits, collect evidence and automate control monitoring in our GRC

platform.

• Vendor and customer assurance. Assess third-party risk before we onboard a vendor and at renewal. Answer customer security

questionnaires and assurance reviews with accurate, reusable evidence and keep our Trust Centre current.

• Hands-on experience with AWS or GCP and working knowledge of the other: IAM, networking, workload security, KMS and audit

logging.

• Securing CI/CD pipelines, infrastructure as code (Terraform or CloudFormation) and containers, with practical use of SAST,

DAST, SCA and secret scanning tools.

• AI and LLM security: the OWASP Top 10 for LLM Applications and the OWASP AI Exchange, and practical experience with the risks

of LLM integrations, agents and connectors (prompt injection, data leakage, excessive agency, supply chain).

• Pragmatic risk judgement. You judge risk by material exposure and real exploitability, and you can explain why a critical tool

score is a medium for us.

Quinyx is a leading workforce management platform, helping businesses simplify scheduling, optimize staffing, and engage their

frontline teams. We empower organizations across the globe, ranging from retail and hospitality to logistics and healthcare, with

smart, mobile-first solutions. Here, you’ll find:

Ready to join the team? Submit your application below, and we’ll be in touch as soon as possible. What our hiring process looks

like:

We celebrate diversity and are committed to creating an inclusive environment for all employees - no matter your background,

identity, or experience.