Manager, Product Security & Architecture

Vacancy Name Manager, Product Security & Architecture

Vacancy No VN1060

Job Title Manager, Product Security & Architecture

Work Location City Minneapolis

About Solifi Solifi deliver a solid financial technology foundation for equipment, working capital, wholesale, and automotive finance firms. At Solifi, we believe that commerce is only as strong as the system it runs on. Our mission is to reshape finance technology by bringing together proven solutions into a singular powerful technology platform designed to help protect and scale financial organizations.

We guard our customers by being precise and reliable, we guide their success by combining powerful technology with proven expertise, and we help them grow by unleashing their potential.

About the Team

The Manager, Product Security & Architecture leads a team of security architects and product security engineers responsible for ensuring Solifi's applications, platforms, and AI capabilities are secure by design. The Manager, Product Security & Architecture will be working cross-functionally with Engineering, Product, Architecture, and Cybersecurity teams.

About the Position Solifi delivers secured finance software across asset and equipment finance, automotive and fleet, wholesale and floorplan, and working capital and invoice finance. Our products run as cloud services on the Solifi Open Finance Platform and, for some clients, as deployments the client hosts themselves.

Security is designed into that portfolio today through our secure SDLC, our architecture and pen testing programmes, and the security work embedded in our engineering teams.

As the portfolio and our AI capability grow, we are investing in a dedicated Product Security & Architecture function to bring that work together under single ownership and scale it deliberately.

Its purpose is to make secure by design the default in how Solifi builds software: security decisions taken at design time, by the engineers closest to the product, with our specialists raising the standard rather than acting as the only line of defence.

This is a build role. The team does not exist yet in its target form, and you will be defining it: the operating model, the roles, the coverage strategy, and the case for the investment behind it.

It is also a player/coach role. With a team of this size, and particularly while you are still building it, you will be doing the work as well as leading it: running threat models yourself, sitting in design reviews, and staying close enough to the technical detail to set standards you have applied in practice. The balance shifts toward coaching as the team comes together, but it never becomes purely a management job.

Role and Responsibilities What you will own:

• Defining and building the function. Shaping the operating model and the team, writing the roles, hiring into them, and setting how the function engages with engineering. Target size is approximately four, expected to include a security architect and product security engineers, but the final shape is yours to propose.
• The scope of the function end to end: threat modelling, application security tooling, security architecture review, secure SDLC gates, the security champions network, and security review of AI features.
• Hands-on delivery alongside the team. Personally leading threat models and architecture reviews on the higher-risk or more novel work, carrying a share of the queue while the team is still forming, and coaching through doing rather than through direction alone.
• Instilling secure by design practice across engineering. Setting the standards, patterns and reusable guardrails that make the secure option the easy one, growing the security champions network, and building engineers' capability so that secure design judgement sits with the delivery teams rather than depending on review. Your team should be raising the ceiling, not becoming a bottleneck.
• Threat modelling coverage strategy across a portfolio of distinct products, including how coverage is divided across the team and rebalanced as products evolve, migrate to OFP, or are added through acquisition.
• Application security tooling strategy, commercially as well as technically. Static and dynamic analysis, software composition analysis, secret scanning and similar, integrated into CI/CD pipelines. You own selection, consolidation, budget and vendor relationships.
• AI security, in both directions. Reviewing AI capability going into Solifi products: model use, data handling, prompt and output risk, agentic tooling, and the classification, transparency and human oversight questions raised by the EU AI Act and comparable regimes emerging in the other markets we serve. And building the case for AI-assisted security review as a way to scale coverage with release volume rather than headcount, including where its output can be relied on and where a human gate stays mandatory. Making that investment case is part of the job, not a given.
• The relationship with Engineering leadership. Securing threat modelling time inside delivery plans and agreeing remediation capacity, working with teams and stakeholders across the UK, North America, India and Serbia.
• Client-facing and audit-facing security work where secure development is in scope: client security assessments and questionnaires, the application pen testing programme and its remediation, and the secure SDLC evidence supporting SOC 2, ISO 27001 and NIST CSF.

You will also work closely with our Vulnerability Operations team on application-layer findings and with Security Engineering on cloud and platform design. Sizing and measuring this function against product complexity and risk surface rather than developer headcount is a position you will need to hold and evidence.

What success looks like in your first year

• The function is defined, staffed and operating, with clear ownership for every activity in scope and named coverage for every product line.
• Threat model review is an established, expected step for new products and features ahead of release.
• Security architecture review has a published SLA and consistently meets it, and engineering teams engage the function early because it is the quickest route to a design that ships.
• Automated and AI-assisted review coverage across releases is measured, improving, and independent of developer count.
• Application-layer findings from pen tests and client assessments close faster, with recurring themes addressed at the design level rather than fixed repeatedly downstream.
• Secure by design is visibly taking hold: security champions active across the engineering geographies, documented patterns and guardrails in use, and delivery teams making sound security calls at design time without waiting on review.
• A funded, evidenced investment plan for the function's next stage.

About You

Essential: • 8+ years in application security, product security or security architecture. • You have owned application security tooling: selected it, rolled it out across engineering teams, and made the findings get fixed. • You have established threat modelling as a routine part of a delivery process in an organisation that was not doing it before. • A track record of instilling secure by design practice in engineering teams through standards, patterns, champions and enablement, so that security capability grows inside delivery rather than sitting solely with the security team. • You can hold a technical position with senior engineering leaders and reach a workable agreement. • People management experience, or clear and evidenced readiness to build and manage a small team including principal-level ICs. • Current hands-on capability, and genuine willingness to use it.

You can lead a threat model or an architecture review yourself, to a standard your team will learn from, and you want a role where that stays part of the job. • Comfortable building something from a standing start, with the judgement to sequence it rather than attempt everything at once.

Valuable: • Experience managing a hybrid team and stakeholders across multiple geographies and time zones. • Fintech, financial services, or regulated multi-product SaaS.

Bonus if you have worked across both modern cloud services and client-hosted deployments, because we have both. • Hands-on AI and LLM feature security review, and a considered view on where AI-assisted security review is and is not trustworthy. • Working knowledge of DORA and the EU AI Act, or comparable regimes elsewhere, and how they land on product development. • Experience representing security to clients, auditors or prospects. • CISSP, OSCP, CCSP or equivalent.

A technical degree is welcome, practical track record matters more. • Exposure to M&A or due diligence work, from either side.

Preferred Experience Level 8 years

Preferred Education Level Bachelor's Degree

Employment Basis Full Time

Benefits Medical, Dental, Vision, Flexible Spend Account (FSA), Health Savings Account (HSA), Life and Accidental Death & Dismemberment (AD&D) Insurance Coverage, Disability Insurance Coverage (Short Term and Long Term), Employee Assistance Program (EAP), 401K Tax Deferred Retirement Savings Plan

Applications Close Date 09 Mar 2027