Full job description

If you’re interested in this role, please apply in English and include an English version of your Resume/CV.

The Role:

As a Security Engineer (Security Architect), you will play a critical role in shaping Moderna’s code security strategy while helping secure our broader hybrid environment across cloud, network, and emerging AI use cases. This role is first and foremost for a strong code security architect. Someone who can assess how software is built, identify risk in custom code and development patterns, and partner with engineering teams to design practical security controls in Source control, Artifact, and CI/CD workflows that improve the resilience of applications and platforms.

This role requires a strategic thinker and technical expert who can lead secure design and review discussions, threat model modern, complex, applications and services, and guide peers toward secure-by-design and secure-by-default practices. In addition to deep application and code security experience, the right candidate should be comfortable operating as a generalist security architect and be able to execute risk assessments across cloud, network, and AI security domains. The ideal candidate will bring enough breadth to assess end-to-end risk, connect control gaps across layers, and provide pragmatic architectural guidance.

Here’s What You’ll Do:

Lead code security enterprise strategy and manage and maintain the primary code security platform.
Lead code security architecture efforts for custom-built applications and services, including secure design reviews, architecture reviews, and risk assessments across the software development lifecycle.
Lead risk assessments across on-prem and cloud environments, identifying vulnerabilities and recommending mitigation strategies. This includes both COTS products and custom inhouse developed services.
Conduct threat modeling exercises for applications, APIs, platforms, and supporting infrastructure to proactively identify abuse paths and control gaps.
Drive security best practices for secure software development, including code security principles, dependency risk management, secrets handling, and secure-by-design engineering patterns.
Assess and advise on security risks across cloud, network, and AI-enabled architectures, ensuring code-level concerns are evaluated in the broader system context.
Identify and remediate security misconfigurations across applications and cloud environments, collaborating with security operations and platform teams to improve prevention, detection, and response.