The role

Wilkes & Liberty needs an independent Security / Architecture Reviewer who can challenge a design early and verify the implemented result later. This is a technical assurance role, not a ceremonial sign-off and not a substitute for Compliance / GRC. You will help teams make trust boundaries, failure behavior, risk decisions, and acceptance evidence explicit before a system reaches a client operator.

What you will own

Model system boundaries, principals, data flows, attack surfaces, abuse cases, deployment dependencies, and the consequences of failure.
Review architecture, code, configuration, and delivery plans across web applications, APIs, identity, infrastructure, data, and AI-enabled workflows.
Test whether authentication, authorization, tenant isolation, secrets handling, file intake, outbound access, audit evidence, and recovery behavior are least-privilege and fail closed where the risk requires it.
Turn material risks into clear engineering requirements and acceptance evidence. Separate confirmed defects, unsupported claims, and accepted residual risk.
Review proposed mitigations, verify closure against the exact changed state, and document decisions and exceptions without overstating assurance.
Support secure handoff and incident readiness with architecture records, threat models, review notes, and operator-facing procedures.
Work with the Compliance / GRC Specialist on applicable obligations while keeping technical security findings distinct from control narratives or certification claims.

What you bring

You can reason across application, API, identity, infrastructure, and data boundaries and explain where final authority and enforcement must live.
You can perform threat modeling, code and configuration review, and focused security testing, then turn the result into changes an engineering team can implement.
You understand authentication and authorization, secrets and key handling, logging and evidence, software supply-chain risk, secure deployment, and failure-mode design.
You can challenge a design without blocking by reflex: you explain the risk, viable options, evidence needed, and who must own the decision.
You distinguish a technical control from a policy statement, and a reviewed design from a certified system.
You write precise findings that identify the affected boundary and state, not vague security advice.

Helpful experience

Drupal or other content platforms, Next.js/Node services, GraphQL or JSON:API, containers, and infrastructure as code.
OAuth/OIDC, workload identity, zero-trust patterns, network and data-boundary design, and secure software delivery.
AI agents, tool authorization, retrieval systems, or other workflows where untrusted input can trigger privileged action.
Federal, regulated, or high-assurance delivery, including work that must map engineering evidence to contractual requirements without claiming certification.

Equal opportunity and accommodations. Wilkes & Liberty considers qualified candidates without regard to protected characteristics. Reasonable accommodations are available during the application process.