Summary of Role
V-Key is one of the world’s leading deep-tech companies in mobile cyber-security. Our patented technology V-OS has been deployed by top banks, mobile payment providers, and governments to secure software solutions and protect more than 500 million users globally.
We are rapidly expanding into new markets and new customer segments. Apart from securing digital transactions for everyone, we are also enabling new generation technology by providing the cyber-security infrastructure for banking, government and smart homes, among many others.
At V-Key, we are building towards a future where technology users can enjoy unprecedented security and convenience.
We are looking for a Security Architect, as part of the Architecture Team.
Duties and Responsibilities
Security Architecture & Strategy
- Contribute to the definition and implementation of application and mobile security architecture, standards, and best practices.
- Develop and maintain reusable security patterns, reference architectures, frameworks, and design guidelines across application and mobile platforms.
- Ensure security designs align with enterprise architecture principles, cloud strategy, technology roadmaps, and post‑go‑live operational requirements.
- Conduct architecture reviews, risk assessments, and threat modelling to support secure solution design.
- Identify design‑level security risks and propose practical, risk‑based mitigation recommendations
- Translate regulatory and internal policy requirements into actionable security architecture controls under guidance from senior stakeholders.
- Support regulatory reviews, audits, and technology risk assessments by providing clear architectural documentation and evidence.
- Contribute to the continuous improvement of application and mobile security maturity, tools, and practices.
Mobile Application & SDK Security
- Define security architecture for mobile applications (iOS / Android) and embedded mobile SDKs.
- Establish standards for secure mobile development, including:
- Secure authentication and authorization
- Secure API consumption and backend integration
- Secure local storage (Keychain / Keystore)
- Runtime protections (anti‑tamper, jailbreak/root detection)
- Address mobile‑specific threat vectors such as reverse engineering, SDK abuse, credential theft, and runtime manipulation.
- Align mobile security architecture with OWASP MASVS / MSTG and organizational security policies.
Cryptography & Post‑Quantum Readiness (PQC)
- Define and govern cryptographic architecture, including encryption, key management, PKI, and secure communications.
- Lead crypto‑agility and PQC readiness initiatives, including:
- Cryptographic inventory and risk assessment (“harvest‑now, decrypt‑later”)
- Design of hybrid cryptographic approaches (classical + PQC‑resistant)
- Alignment with NIST PQC standards and industry guidance
- Ensure cryptographic controls are consistently applied across applications, mobile SDKs, APIs, and cloud services.
Cloud, API & DevSecOps Security
- Provide security architecture guidance for cloud‑native, containerized, and API‑driven architectures.
- Support secure development, deployment, and integration across platforms and environments
- Embed security controls into DevSecOps practices and CI/CD pipelines, including mobile build pipelines.
Requirements
- Bachelor’s degree in Computer Science, Information Systems, Engineering, or a related discipline.
- 4–7 years of experience in application security, mobile security, cloud security, or security engineering.
- Practical experience contributing to security architecture or design reviews.
- Strong understanding of application and mobile security principles, including iOS / Android and mobile SDK security.
- Familiarity with mobile threats such as reverse engineering, tampering, SDK abuse, and credential theft.
- Working knowledge of OWASP Top 10 and OWASP MASVS / MSTG.
- Solid understanding of cryptographic fundamentals (TLS, encryption, key management, PKI) and exposure to crypto‑agility and Post‑Quantum Cryptography (PQC) concepts.
- Experience securing cloud platforms (AWS and/or Azure), including IAM, data protection, and secure networking.
- Familiarity with API security, cloud‑native architectures, and DevSecOps / CI/CD security practices.
- Experience participating in threat modelling (e.g. STRIDE, MITRE ATT&CK) and design‑level risk assessments.
- Awareness of regulatory and internal security policy requirements and experience supporting audits or risk assessments.
- Strong communication and collaboration skills, with the ability to work effectively across engineering, platform, risk, and compliance teams.
- Relevant certifications (e.g. Security+, cloud associate, or progress toward CISSP / CCSP / CISM) are a plus.
Skills Required
- Bachelor's degree in Computer Science, Information Systems, Engineering, or related discipline
- 4-7 years' experience in application security, mobile security, cloud security, or security engineering
- Practical experience contributing to security architecture or design reviews
- Strong understanding of iOS and Android mobile security and mobile SDK security
- Familiarity with mobile threats (reverse engineering, tampering, SDK abuse, credential theft)
- Working knowledge of OWASP Top 10 and OWASP MASVS / MSTG
- Solid understanding of cryptographic fundamentals (TLS, encryption, key management, PKI)
- Exposure to crypto-agility and Post-Quantum Cryptography (PQC) concepts
- Experience securing cloud platforms (AWS and/or Azure), including IAM, data protection, and secure networking
- Familiarity with API security, cloud-native architectures, and DevSecOps / CI/CD security practices
- Experience participating in threat modelling (e.g., STRIDE, MITRE ATT&CK) and design-level risk assessments
- Awareness of regulatory and internal security policy requirements and experience supporting audits or risk assessments
- Strong communication and collaboration skills across engineering, platform, risk, and compliance teams
- Relevant certifications (e.g., Security+, cloud associate, progress toward CISSP/CCSP/CISM)
What We Do
V-Key is a global leader in software based digital security, and is the inventor of V-OS, the world's first virtual secure element. FIPS 140-2 Validated and accredited by IMDA, V-Key's Security, Authorization, and Verification solutions are used widely across banking and government mobile and digital platforms across the region. ★ The World's First Deployed by top banks, mobile payment providers, and governments globally, V-OS is the world’s first virtual secure element. With V-OS as a strong security base, V-Key is able to provide a complete mobile application security for any mobile application. Our solutions allow businesses to roll out cloud-based payments, trusted authentication for mobile banking, and other secured mobile applications for user data protection without the need to use any form of hardware secure elements. After all, software security is the new hardware. ★ Certified Cryptography Using a FIPS 140-2 certified module for cryptographic assurance, our solutions have been accredited and accepted by multiple government agencies and regulatory bodies globally. The hardened V-OS virtual machine has been proven in multiple penetration tests to be able to withstand many classes of hacking attacks that are rarely protected against – challenging security standards previously held by hardware tokens. This allows our customers to easily comply with stringent regulatory requirements and other security requirements of cloud-based payments and mobile transactions. ★ Patented Protections V-OS has been architected and developed like a hardware encryptor in order to provide military-grade protection for your mobile app. Traditional tamper-protection relies on techniques such as code obfuscation, whitebox cryptography, and anti-tampering / anti-debugging mechanisms. V-Key tightly integrates these best-of-breed techniques into the V-OS virtual machine in a groundbreaking manner in order to create a reinforcing system of protection. (tag: vkey, mobile app protection, digital identity, 2fa, mfa)
