Software Architect, Security

At JFrog, we’re reinventing DevOps to help the world’s greatest companies innovate – and security is a core part of our mission. Our team of industry-leading software security experts are true pioneers, constantly pushing the boundaries with original research and technology innovation. JFrog is a special place with a unique combination of brilliance, spirit and just all-around great people. Thousands of customers, including the majority of the Fortune 100, trust JFrog to manage, accelerate, and secure their software delivery from code to production – a concept we call “liquid software.” Wouldn't it be amazing if you could join us on our journey?

We're looking for a Software Architect, Security with a strong background to lead security for the architecture enablement team in the R&D group that builds the JFrog Platform, including Artifactory. This is a hands-on role for an experienced engineer who has built production systems and knows how they get broken. You'll sit with engineering teams, review designs, and help build the guardrails, tooling, and AI-assisted workflows that keep our products secure.

• Raise the security awareness of JFrog engineers by building and driving programs that help them recognize security best practices, anti-patterns, and common mistakes before code ships.
• Improve adoption of security best practices in JFrog products:
• Define and continuously improve clear security rules and architectural guardrails.
• Build, adopt, and tune automated security reviews as part of the pull-request process.
• Define and adjust AI-assisted skills and workflows so security is considered during design and planning, not only at review time.
• Actively participate in preventing and resolving common attacks such as SSRF, XSS, SQL injection, and broken access control, among others. Be the first person engineers go to for how to fix these problems correctly, and proactively propose architectural improvements that solve them centrally rather than one bug at a time.
• Work in coordination with JFrog's CISO and AppSec teams to help shape and adopt company-wide security policies within the R&D group that builds the JFrog Platform, including Artifactory.
• Act as a central technical figure in group-wide initiatives such as FedRAMP certification, post-quantum cryptography readiness, and similar projects as they arise.

• Experience as an Architect, Principal Engineer, or Staff Engineer, with a strong security background. This is a deeply technical, hands-on role, not an advisory one.
• A track record of giving hands-on technical assistance to development teams, not just guidance from a distance.
• Deep, practical, production-level experience in Java or C# and their ecosystems. Familiarity with Go, TypeScript, or Python is an advantage.
• Solid understanding of modern architecture patterns across cloud-native (AWS, GCP, Azure) and self-hosted/on-prem deployments.
• Strong knowledge of networking fundamentals and authentication/authorization protocols such as OAuth2/OIDC, SAML, and mTLS.
• Practical knowledge of common attack classes and how to fix them correctly, such as SSRF, XSS, SQL injection, and broken access control, among others.
• Excellent communication skills and the ability to self-manage. You'll set direction across a large, multi-team organization with far more influence than direct authority.
• Comfort operating as an enabler: teaching, tooling, and influencing rather than gatekeeping.
• Familiarity with security and compliance certifications such as FedRAMP and Common Criteria – advantage.
• Exposure to post-quantum cryptography concepts and migration planning – advantage.
• Experience shaping or reviewing AI-assisted development workflows such as AI coding agents or skills – advantage.
• Prior experience in an enablement, platform, or developer-experience role influencing many teams at once – advantage.