Senior Threat Modeler

What You Will Be Responsible For

• Conduct threat modeling activities for business applications, cloud-native platforms, APIs, and strategic technology initiatives.
• Analyze application architectures, data flows, trust boundaries, and cloud deployments to identify security threats and design weaknesses.
• Partner with application development, cloud engineering, and security teams to recommend practical risk mitigation strategies and secure design improvements.
• Perform security assessments using established methodologies such as STRIDE, MITRE ATT&CK, attack trees, and risk-based analysis techniques.
• Contribute to the development of threat modeling standards, reusable patterns, training materials, and secure-by-design practices across the enterprise.

Why This Role Is Important To Us

The team you will be joining is part of the Security Architecture organization, a function that is critical to protecting the firm's applications, data, cloud environments, and technology services. Threat modeling enables the organization to proactively identify security weaknesses, reduce cyber risk, improve architectural resiliency, and ensure security requirements are incorporated into technology solutions from inception through deployment.

Education & Preferred Qualifications

• Degree in Computer Science, Cybersecurity, Information Technology, Engineering, or a related discipline.
• 12 years or more of experience in application security, cloud security, cybersecurity architecture, threat modeling, or related technology disciplines, with at least 7 years of hands-on cybersecurity experience preferred.
• Demonstrated experience conducting threat modeling exercises for enterprise applications, APIs, cloud platforms, and distributed systems.
• Strong expertise in application security principles, secure software development lifecycles, OWASP Top 10, API security, and secure coding practices.
• Experience assessing and securing cloud environments across AWS, Azure, and/or Google Cloud Platform.
• Knowledge of microservices, containers, Kubernetes, CI/CD pipelines, DevSecOps practices, and modern software architectures.
• Experience with threat modeling methodologies such as STRIDE, MITRE ATT&CK, attack trees, and adversary-based risk analysis.
• Professional certifications such as CISSP, CCSP, CSSLP, GWAPT, GWEB, AWS Security Specialty, Azure Security Engineer, or equivalent security certifications are highly desirable.
• Experience within financial services or other highly regulated industries is preferred.

Additional Requirements

• Ability to effectively collaborate with development, engineering, architecture, and cybersecurity teams.
• Strong written and verbal communication skills with the ability to present technical findings to both technical and non-technical audiences.
• Limited travel may be required based on business needs.