Senior Security Architect

Security Architect Location: Aarhus, Hamburg, Malaga, Oslo or Copenhagen Type: Hybrid & Full-time About the Job We are looking for a Senior Security Architect to shape and strengthen security across Stibo DX products, platforms, and cloud services. You will join a small, senior architecture team at the center of Stibo DX's transformation from self-hosted and hybrid deployments to a standardized, cloud-native SaaS platform. This is a hands-on, embedded role. You will work with engineering, product, platform, operations, customer-facing teams, and legal to ensure security is built into our solutions by design, not added afterwards. You will turn security strategy and risk into practical architecture, reusable patterns, and controls that teams can implement. Your goal is to establish a consistent security architecture across Stibo DX and give teams clear standards, patterns, and guardrails to make secure architecture decisions. Early priorities will include establishing a security architecture baseline, identifying key security gaps across our SaaS platform, strengthening security architecture reviews and threat modelling, and defining reusable security patterns for engineering teams. The role is primarily focused on security architecture, product and platform security, and secure engineering practices. You will also drive the technical aspects of security governance and support compliance activities when needed, including security certifications, customer security requirements, regulatory obligations, risk assessments, policies, and audit preparation. You will work alongside peer architects covering Software, Platform/Infrastructure, and Data/Integration, reporting to the Director of Solution Architecture. Our governance model is based on minimum necessary control: decisions close to teams, with oversight proportional to risk and impact. Security remains a shared responsibility. The Senior Security Architect owns the security architecture direction, standards, patterns, and cross-cutting guidance, while Software, Platform/Infrastructure, and Data/Integration architects continue to consider and address security within their respective domains. Engineering teams remain responsible for implementing and operating the required controls. What You'll Do

• Define security architecture strategy across Stibo DX products, platforms, and cloud services, including principles, standards, target architectures, guardrails, and roadmaps.
• Embed secure-by-design practices into product discovery, solution design, delivery, and operation, working with teams early rather than reviewing security only at the end.
• Lead security architecture reviews and threat modelling for product, platform, customer, and technology initiatives; identify risks and align on practical mitigation with accountable teams.
• Shape identity and access management covering authentication, authorization, federation, privileged access, service identities, secrets, and Zero Trust principles.
• Strengthen cloud and platform security for AWS, Kubernetes, networks, workloads, infrastructure as code, CI/CD, data, and shared SaaS platform capabilities.
• Define reusable security patterns and controls for APIs, integrations, multi-tenancy, tenant isolation, encryption, key management, logging, monitoring, vulnerability management, and secure configuration.
• Embed security in the software development lifecycle by defining practices and guardrails and helping teams integrate security into engineering practices, automation, architecture decision records, and delivery pipelines.
• Lead security governance and compliance work when needed including security policies, control design, risk assessments, evidence coordination, audit preparation, and remediation planning.
• Translate external requirements into technical action including customer security expectations, contractual commitments, privacy requirements, and relevant frameworks such as ISO 27001, SOC 2, GDPR, and CRA.
• Raise security maturity across Stibo DX through coaching, practical guidance, cross-team collaboration, and clear communication with technical and non-technical stakeholders.

What we're looking for Experience

• 10+ years of experience across software engineering, cloud/platform engineering, or cybersecurity, with 4+ years in a senior security architecture or technical security leadership role.
• Proven experience designing and securing cloud-native, distributed, and microservices-based systems in production.
• Practical experience with SaaS and multi-tenant architectures, including tenant isolation, identity, data protection, and shared platform controls.
• Experience leading threat modelling, security architecture reviews, risk assessments, and remediation planning across multiple teams or product areas.
• Experience defining security standards, patterns, reference architectures, and governance that teams can apply in practice.
• Experience working with security and compliance frameworks and translating them into proportionate technical and organizational controls.
• Strong communication skills and the ability to influence engineers, architects, product leaders, operations, customers, legal, and senior stakeholders.

Technical expertise

• Cloud security, preferably AWS, and Kubernetes/container security.
• Identity and Access Management, OAuth 2.0, OpenID Connect, SAML, federation, privileged access, and service identities.
• Application, API, integration, and event-driven security.
• Network security, workload protection, secrets management, encryption, certificates, and key management.
• Secure software development lifecycle, DevSecOps, infrastructure as code, CI/CD security, and software supply-chain security.
• Security logging, monitoring, detection capabilities, vulnerability management, and incident preparedness.
• Threat modelling, security risk analysis, Zero Trust, and defense-in-depth principles.

Nice to have

• Experience leading or materially supporting ISO 27001, SOC 2, GDPR security controls, CRA, or similar initiatives.
• Experience with enterprise customer security assessments, contractual security requirements, and audit evidence coordination.
• Relevant certifications such as CISSP, CCSP, SABSA, AWS Certified Security - Specialty, or equivalent practical experience.
• Experience helping an organization establish or mature a security architecture and governance capability.

Personal qualities

• Hands-on and credible with engineers, while able to communicate security clearly with product, customers, legal, and leadership.
• Pragmatic and risk-based: able to balance security, usability, operational complexity, cost, and delivery speed without compromising critical controls.
• Collaborative and influential, using expertise, evidence, and trust rather than creating unnecessary gates.
• Structured and decisive, able to make risks, responsibilities, and architectural decisions explicit.
• Curious, adaptable, and motivated by building long-term security maturity while helping teams deliver now.

What We Offer

• Real influence on the security foundations of Stibo DX's cloud-native SaaS transformation.
• Ownership of security architecture and a central role in shaping security governance and compliance maturity.
• Hands-on work on real product, platform, customer, and operational challenges, not security from an ivory tower.
• A small, senior architecture team with trust, autonomy, and meaningful responsibility.
• High visibility across product, engineering, operations, customer-facing teams, legal, and leadership.
• The opportunity to create reusable security practices and patterns with lasting impact across Stibo DX.

Interested? Apply at your earliest convenience. Short-listed candidates will be invited for an interview. Applications are processed as they are received until the right candidate is found. For any questions, please reach out to hiring manager Safdar Aqeel Safdar on safs@stibodx.com. Help us empower storytellers across the globe Stibo DX is the global leader in digital transformation for media enterprises. Our platform and services help automate complex content production and enable omnichannel delivery for some of the world's most ambitious and successful media organizations. We are a global and dynamic team of over 200 employees based in Aarhus, Copenhagen, Atlanta, Hamburg, Oslo, and Málaga, combining creativity and innovation with the stability of a long-standing organization. Stibo DX is part of the Stibo Software Group, the second-largest Danish-owned software group. Our roots trace back to the Stibo Foundation, which has a 228-year history and a rich legacy that supports our continued growth. Among our customers are The New York Times, Hearst, Gannett, The Economist, A-Media, JP/Politikens Hus, Mediahuis, The Hindu, and many others. If you want to be part of a team where individuals are valued and trust is a driver, we encourage you to apply today!