Senior Security Architect

As Senior Security Architect (m/f/d) at Qivalis, you will shape the security architecture of the whole company: our platform, custody and payment integrations, smart contracts, workforce identity, SaaS estate and AI integrations. You set the security requirements, trust boundaries and patterns our systems must follow, ensure they are practical to build and run, and are the security voice in the architecture decisions our CTO takes.

This senior individual contributor role sits in our fully remote security team and works closely with the platform, backend and blockchain engineers who turn security designs into production systems. This role covers security design across identity, cryptography and threat modelling, including custody and our readiness for post-quantum cryptography. This is a chance to truly shape how Europe’s bank-backed euro stablecoin is secured., * Own the security reference architecture for our cloud-native platform, custody and payment integrations, together with Platform Engineering, and maintain the technical security standards and architecture decision records our teams build against.

• Review designs and changes that introduce new patterns, change trust boundaries or affect critical functions, within agreed response times, so security never becomes a bottleneck.
• Own the end-to-end identity architecture across workforce, customer and platform identities, including federation, workload identity, service-to-service authentication (mTLS, authorisation policies) and privileged access patterns.
• Define authentication and authorisation for our APIs and services, and work with backend engineers on the secure design of new services and integrations.
• Own our cryptographic standard, crypto inventory and post-quantum readiness roadmap, define the secrets management pattern, and set the security design of our custody setup, including key management and transaction controls.
• Lead threat modelling for critical functions, custody, smart contracts and new integrations, run AI security risk assessments, and turn regulatory and technology developments such as the EU AI Act, eIDAS 2.0, MiCA Level 3 and the digital euro into architecture decisions.
• Shape detection and logging requirements, scope penetration tests and red-team exercises and turn their findings into structural design fixes, and act as technical expert in audits and supervisory interviews., 2. Hiring Manager interview: A deep dive into the role with our Head of Security Compliance & Operations, covering its responsibilities, priorities, and how your experience fits. 3. Technical interview: A hands-on architecture case, where you’ll work through a real challenge we face. 4. Team interview: A conversation with members of our Platform Engineering team about how you’d work together on cloud, Kubernetes and identity architecture, and how you turn security decisions into practice. 5. Cultural-Add call: A final conversation with our Head of HR about what you’d bring to the team: your perspective, values, and approach.

• 10+ years in security engineering or security architecture, at least three of them in financial services or critical infrastructure, with a track record in hands-on technical security roles rather than governance or compliance.
• Proven ownership of identity and access architecture in cloud-native environments, including federation, workload identity and privileged access.
• Deep cloud-native security architecture experience across AWS, Kubernetes, service mesh and secrets management.
• Strong applied cryptography: key management, TLS and mTLS, signing, and HSM- or MPC-based custody.
• Experience defining API authentication and authorisation mechanisms, e.g. OAuth 2.0 / OIDC, token validation and request signing.
• A track record of influencing engineering teams without formal authority

• Excellent written and spoken English. Nice to Have

• Blockchain and smart contract security, such as upgrade patterns, role management, and oracle and bridge risks.
• Post-quantum cryptography and crypto-agility.
• Structured threat modelling (e.g. MITRE ATT&CK, STRIDE, attack trees), including leading threat modelling sessions.
• Working knowledge of DORA, MiCA, ISO 27001:2022 and the EU AI Act, enough to turn them into architecture decisions.
• Experience with AI security risks in development workflows.
• Payment messaging security (SWIFT, SEPA).
• Published research, conference talks or open-source contributions;
• German is a plus.

Core Competencies

Architectural judgement: You see the system as a whole, set clear trust boundaries and patterns, and make trade-offs explicit, choosing pragmatism over buzzwords.

Technical depth: You go deep on cloud, identity and cryptography, and can defend a design decision in detail with the engineers who build it.

Influence through writing: You bring engineering teams with you through clear written decisions and pragmatic trade-offs, building security that engineers want to use.

European by design. Headquartered in Amsterdam. Qivalis is building a regulated, euro-denominated stablecoin backed by a consortium of leading European banks. Operating across Europe, Qivalis is creating trusted on-chain payment infrastructure for Europe’s digital economy.

Qivalis’ mission is to provide a secure, transparent, and institutionally trusted on-chain euro that serves as a foundational settlement asset for Europe’s digital economy. By bridging traditional financial infrastructure and blockchain technology, Qivalis enables regulated, scalable, and future-proof payment and settlement use cases for banks, financial institutions, and capital markets.