Security Architect - NetBox Labs

NetBox Labs builds NetBox, the open source network source of truth, and the cloud and enterprise products built on it. We're hiring a hands-on Security Architect: a builder unleashed by AI, who designs and ships the systems that keep our products, our cloud, and our company secure as we grow.

AI agents do most of the coding. You bring the judgment: what good looks like at scale, which outcomes matter, and when an agent's output is plausible but wrong. You own what ships and run it in production.

Most of the role is Applied AI: building the platforms and paved paths that let teams across the company build their own automations, agent workflows, and software, secure by default, with identity, data access, and cost controls built in. You'll also work as a forward-deployed engineer, embedded with teams to get their first workflows running and turn what works into patterns. Success looks like teams building and running their own workflows on secure, pre-approved paths without waiting on a security review, and patterns you built being reused well beyond the team that first asked for them. The rest of the role is security engineering, with a focus on turning security from a review step into paved paths that engineering uses by default.

You'll report to the Director of Security & IT and work with Engineering, Product, Sales, Customer Success, and Finance.

What you'll do

Make secure AI adoption the easy path

• Build and run the platforms that let teams across the company build their own automations, agent workflows, and software on a secure path by default, with the guardrails built in: pre-approved tools and connectors, scoped identities and credentials, authorization on data retrieval, approval for consequential actions, audit logging, and cost limits.
• Lead enablement so teams can self-serve: templates, starter kits, and reference patterns that make the secure way the fastest way to build, plus the guidance and support to use them well.
• Work alongside teams outside Engineering on their first workflows, then turn what you build into patterns others pick up without you.
• Set evaluation criteria and quality gates for agent workflows built on the platform, covering accuracy, safe use of tools and data, and how they handle failure.

Automate security into how we build and ship

• Build security into the SDLC and PDLC: threat modeling, secure design review, code scanning, secret detection, and supply-chain and CI/CD controls enforced in the pipeline.
• Automate product and cloud security reviews so coverage keeps pace with delivery.
• Automate vulnerability intake, prioritization, routing, and SLA escalation so the team works the highest-risk findings first.

Automate Security & IT operations

• Build access automation as code, with just-in-time elevation for privileged access.
• Set multi-account AWS guardrails and reference architectures for identity, network, and data.

Run what you build

• Own the services you build end to end: CI/CD, deployment, monitoring, alerting, runbooks, and incident response. You'll join the Security & IT on-call rotation once the systems you own alert on failure. Internal platforms are supported during business hours.

What you bring

• 12+ years across security architecture, cloud infrastructure, and enterprise IT.
• Architecture decisions that held up as companies grew, and a deep understanding of what breaks first at scale.
• Experience recently building and running something other people depend on by directing agents or otherwise: a product, a platform, or an internal tool.
• Ability to build with AI agents as your primary engineering tool across Python, Go, TypeScript, and Terraform.
• Experience shipping LLM or agent systems to production with proper evaluation, tool and MCP governance, and retrieval access controls.
• Ability to tie security work to product and business outcomes and communicate tradeoffs effectively to executives.
• Deep AWS experience: multi-account organizations, identity, network security, and infrastructure as code.
• Zero Trust and identity architecture in practice for both workforce and services.
• Product security depth: threat modeling, secure design review, supply-chain security, and SDLC automation.
• A default approach of delivering everything as code: infrastructure, policy, detections, and controls.
• A platform mindset focused on empowering teams to build securely by choice.

Nice to Have

• Security architecture for a SaaS product.
• Background in a regulated or high-trust environment, or experience with compliance programs like SOC 2 or ISO 27001.
• Multi-tenant SaaS security, including tenant isolation.
• Experience building detections and monitoring for systems you own.
• Experience with a second cloud provider.