Software Architect, Security at JFrog

The role

JFrog, which makes the JFrog Platform including Artifactory, wants a Software Architect, Security for its R&D group's architecture enablement team, which works on that platform. Its ad lists the location as Tel Aviv or Netanya. This is hands-on work, best suited to a seasoned engineer who knows how live systems are built and how they get attacked. You would work alongside engineering teams, review their designs, and create the guardrails, tools and AI-assisted workflows that keep the products secure.

What you will do

• Run programs that teach engineers good security practice, bad patterns and common mistakes before their code ships.
• Write architectural guardrails and security rules, and keep improving them.
• Put automated security reviews into the pull request process, whether built in-house or adopted, and tune them.
• Define workflows and skills for AI assistants so security comes up during design and planning, and not only at review.
• Help prevent and resolve attacks such as XSS, SSRF, broken access control and SQL injection, acting as engineers' first contact for fixing them properly.
• Propose architecture changes that remove whole classes of problem instead of fixing one bug at a time.
• Work with the CISO and AppSec teams to shape company security policy and apply it within the R&D group.
• Play a central technical part in group-wide projects such as FedRAMP certification and readiness for post-quantum cryptography.

What you need

• A background as a Staff or Principal Engineer or an Architect, with strong security experience. The job is technical and hands-on, not advisory.
• A record of directly helping development teams with technical problems.
• Deep production experience with Java or C# and their ecosystems.
• A solid grasp of modern architecture, both self-hosted or on-prem and cloud-native (AWS, GCP, Azure).
• Strong networking fundamentals, and knowledge of identity and access protocols such as mTLS, SAML and OAuth2/OIDC.
• Practical knowledge of common attack types and the correct fixes for them.
• Excellent communication, the ability to manage yourself, and the skill to lead a large multi-team organization through influence more than authority.
• Comfort with teaching, building tools and persuading, rather than acting as a gatekeeper.

Nice to have

• Go, TypeScript or Python.
• Certifications and compliance programs such as FedRAMP and Common Criteria.
• Post-quantum cryptography concepts and migration planning.
• Shaping or reviewing AI-assisted development, such as coding agents or skills.
• Having influenced many teams from a platform, enablement or developer experience job.