Security Architect

500M+ downloads. 80M+ monthly users. A decade of building – and we’re still accelerating.

Flo is the world’s #1 health & fitness app worldwide on a mission to build a better future for female health. Backed by a $200M investment led by General Atlantic, we became the first product of our kind to reach a $1B valuation in 2024 – and we’re not slowing down.

With 7M paid subscribers and the highest-rated experience in the App Store’s health category, we’ve spent 10 years earning trust at scale. Now, we’re building the next generation of digital health – AI-powered, privacy-first, clinically backed – to help our users know their body better.

The job

Millions of people trust Flo with their most personal health data. As our Security Architect, you’ll make sure we deserve that trust. This is a hands-on individual contributor role. You’ll work side by side with engineering, product and platform teams to shape secure architectures and build the guardrails that let both humans and AI coding agents ship quickly and safely. The role combines security architecture, product and application security engineering and security risk expertise: you will set secure patterns and standards, lead threat modelling and design reviews, embed security into the SDLC and CI/CD, and translate security risk into clear, pragmatic decisions.

What you’ll do

Shape secure architecture from day one. Partner with teams early in design, lead security design reviews for new services and major changes, and record key decisions and risk trade-offs.

Build security harnesses for human and AI-agent development. Design guardrails, sandboxing, least-privilege access for agents and tools, secrets handling, policy-as-code and automated checks that run inside developer and agent workflows.

Lead on AI and agentic security. Define secure patterns for LLM integrations, MCP servers and tool use, and tackle risks like prompt injection, data leakage, excessive agency and supply-chain compromise.

Create paved roads. Publish reusable patterns, reference architectures and standards that teams adopt because they’re the easiest option.

Scale threat modelling. Build tools and skills that let engineers run threat models themselves, and carry out internal security assessments.

Remove whole classes of vulnerabilities. Automate vulnerability triage and investigation, find systemic root causes, and feed the fixes back into patterns and guardrails.

Turn risk into clear decisions. Explain security risk in pragmatic terms so the business can prioritise based on risk and value.

Advise and enable. Be a trusted partner to engineering, product and leadership, coach engineers, and help evaluate third-party and AI tools so they can be adopted securely. Support ISO 27001/27701 so that controls are built into how we engineer, not bolted on afterwards.

What you’ll bring

7+ years in security engineering, application/product security or security architecture, including hands-on work securing cloud-native systems

Deep knowledge of Secure SDLC: threat modelling, security testing, app security review and CI/CD security

Hands-on experience with AWS and Cloudflare (or equivalents) and Terraform or similar IaC

A strong grasp of the OWASP Top 10 and the ability to assess exploitability and impact

Solid coding skills (e.g. Python, Go, Scala) and experience building security tooling or automation

Practical understanding of the risks in AI-assisted and agentic development and LLM applications (e.g. OWASP Top 10 for LLMs)

Experience with security risk analysis and risk management methods

The ability to explain trade-offs clearly to engineers and senior stakeholders, and to win people over

Nice to have

Experience building guardrails, sandboxes or policy-as-code (e.g. OPA) for developer platforms or AI coding agents

iOS or Android security experience

Experience with ISO 27001, ISO 27701 or SOC 2 audits

A background in health tech, femtech or another regulated, privacy