Security Architect, Product

College Board - Technology - Product Security Location: This is a fully remote role. Candidates who live near CB offices have the option of being fully remote or hybrid (Tuesday and Wednesday in office). Type: This is a full-time position About the Team College Boards' Product Security team is a close-knit group of technologists focused on building secure, cloud-native products. We partner closely with product and engineering teams to identify risks early, solve hard problems, and enable delivery through practical security architecture and DevSecOps practices. We value diverse perspectives and ensure every voice is heard. Security Architects collaborate with product teams and key stakeholders to translate business needs into secure design decisions. They lead threat modeling and architecture reviews, help teams adopt secure development practices, and contribute to security standards and tooling decisions. About the Opportunity As a Product Security Architect, you will serve as a trusted advisor to product teams building and operating multi-tenant SaaS applications that support millions of students. You’ll guide secure-by-design architecture, lead threat modeling and design reviews, and help teams make practical trade-offs across security, privacy, resilience, and delivery. This role requires strong judgment and agency. You will be expected to make risk-based decisions [... source excerpt omitted ...] y. You will also help shape security architecture for high-trust assessment experiences and large-scale integrations common in K–12 and higher education ecosystems. In this role, you will: Secure SaaS Architectures (50%) Serve as a trusted security advisor to engineering and product teams, offering clear guidance on secure architecture, design decisions, and remediation strategies. Review system and application architectures, identifying gaps, recommending enhancements, and aligning solutions with College Board’s Product Security Framework and zero-trust principles. Partner with product teams early in the lifecycle to conduct architectural assessments, threat modeling, and d [... source excerpt omitted ...] , access control and data protection, and serverless design patterns. Provide architectural guidance that supports audit and compliance readiness by ensuring security and privacy requirements are reflected in system design, technical controls, and documented patterns. Support the evaluation of new technologies, third-party integrations, and design proposals to assess security impact and ensure alignment to enterprise standards, including large-scale customer integrations (SSO/identity federation and data exchange) common in K–12 and higher education ecosystems Partner with engineering teams to evaluate failure modes, dependency risks, and systemic weaknesses as part of architectur