Security Architect

500M+ downloads. 80M+ monthly users. A decade of building – and we’re still accelerating. Flo is the world’s #1 health & fitness app worldwide on a mission to build a better future for female health. Backed by a $200M investment led by General Atlantic, we became the first product of our kind to reach a $1B valuation in 2024 – and we’re not slowing down. With 7M paid subscribers and the highest-rated experience in the App Store’s health category, we’ve spent 10 years earning trust at scale. Now, we’re building the next generation of digital health – AI-powered, privacy-first, clinically backed – to help our users know their body better.

The job: Millions of people trust Flo with their most personal health data. As our Security Architect, you’ll make sure we deserve that trust. This is a hands-on individual contributor role. You’ll work side by side with engineering, product and platform teams to shape secure architectures and build the guardrails that let both humans and AI coding agents ship quickly and safely. The role combines security architecture, product and application security engineering and security risk expertise: you will set secure patterns and standards, lead threat modelling and design reviews, embed security into the SDLC and CI/CD, and translate security risk into clear, pragmatic decisions.

What you’ll do:

• Shape secure architecture from day one. Partner with teams early in design, lead security design reviews for new services and major changes, and record key decisions and risk trade-offs.
• Build security harnesses for human and AI-agent development. Design guardrails, sandboxing, least-privilege access for agents and tools, secrets handling, policy-as-code and automated checks that run inside developer and agent workflows.
• Lead on AI and agentic security. Define secure patterns for LLM integrations, MCP servers and tool use, and tackle risks like prompt injection, data leakage, excessive agency and supply-chain compromise.
• Create paved roads. Publish reusable patterns, reference architectures and standards that teams adopt because they’re the easiest option.
• Scale threat modelling. Build tools and skills that let engineers run threat models themselves, and carry out internal security assessments.
• Remove whole classes of vulnerabilities. Automate vulnerability triage and investigation, find systemic root causes, and feed the fixes back into patterns and guardrails.
• Turn risk into clear decisions. Explain security risk in pragmatic terms so the business can prioritise based on risk and value.
• Advise and enable. Be a trusted partner to engineering, product and leadership, coach engineers, and help evaluate third-party and AI tools so they can be adopted securely. Support ISO 27001/27701 so that controls are built into how we engineer, not bolted on afterwards.

What you’ll bring:

• 7+ years in security engineering, application/product security or security architecture, including hands-on work securing cloud-native systems.
• Deep knowledge of Secure SDLC: threat modelling, security testing, app security review and CI/CD security.
• Hands-on experience with AWS and Cloudflare (or equivalents) and Terraform or similar IaC.
• A strong grasp of the OWASP Top 10 and the ability to assess exploitability and impact.
• Solid coding skills (e.g. Python, Go, Scala) and experience building security tooling or automation.
• Practical understanding of the risks in AI-assisted and agentic development and LLM applications (e.g. OWASP Top 10 for LLMs).
• Experience with security risk analysis and risk management methods.
• The ability to explain trade-offs clearly to engineers and senior stakeholders, and to win people over.

Nice to have:

• Experience building guardrails, sandboxes or policy-as-code (e.g. OPA) for developer platforms or AI coding agents.
• iOS or Android security experience.
• Experience with ISO 27001, ISO 27701 or SOC 2 audits.
• A background in health tech, femtech or another regulated, privacy-sensitive industry.
• Certifications or degrees such as CISSP, CCSP, OSCP or an MSc in Information Security.

Why Flo: You’ll protect data that matters deeply to millions of people. You’ll also help set the standard for how a company adopts agentic engineering safely, and you’ll have real ownership: you design and build the first version, then hand it off to the teams who will run it.

Annual Salary Range (ranges may vary based on skills and experience): 100,000—130,000 GBP.

How we work: We’re a mission-led, product-driven team. We move fast, stay focused and take ownership – from brief to build to impact. Debate is encouraged. Decisions are shared. We care about craft, ship with purpose, and always raise the bar. You’ll be working with people who take their work seriously, not themselves. It takes commitment, resilience, and the drive to keep going when things get tough. Because better health outcomes are worth it.

What you'll get: We support impact with meaningful reward. Here’s what that looks like:

• Competitive salary and annual reviews.
• Opportunity to participate in Flo’s performance incentive scheme.
• Paid holiday, sick leave, and female health leave.
• Enhanced parental leave and pay for maternity, paternity, same-sex and adoptive parents.
• Accelerated professional growth through world-changing work and learning support.
• In-person collaboration and work in a hybrid model, with 3 days per week spent in the office.
• 5-week fully paid sabbatical at 5-year Floversary.
• Flo Premium for friends & family, plus more health, pension and wellbeing perks.

Diversity, equity and inclusion: Our strength is in our differences. At Flo, hiring is based on merit, skill and what you bring to the role – nothing else. We’re proud to be an equal opportunity employer, and we welcome applicants from all backgrounds, communities and identities.