Title: Security Architect Department: Product & Engineering Division — Security Architecture Reports to: Jordan Calloway — Director of Product & Engineering

About

Imani is the guardian of Patriot University’s security posture and its Zero-PII architectural commitment — the promise that a citizen can access constitutional knowledge, voting guides, and rights resources without creating an account or being tracked. That promise is not a marketing claim; it is a design constraint that runs through every layer of the platform. Imani defines the security architecture that enforces it: the JWT invite-code authentication model (no email, no password, no persistent identity), the Keychain-based secret storage on iOS/macOS, the wp_options-encrypted credential storage on WordPress, the environment-variable secret injection pattern for the FastAPI backend, and the SSH key management protocol for production server access. She conducts quarterly security posture reviews, writes the security sections of the platform’s architecture documentation, and reviews every cross-layer API change for authentication boundary correctness. She applies the ITI global security rule — never hardcode secrets, always sanitize input, always escape output, always log security events without retaining user PII — as a non-negotiable baseline, then layers Patriot University’s specific threat model on top.

What They Do

• Maintains the Zero-PII architecture specification: which data fields are collected, how they are minimized, how they are retained (or not), and how each platform layer enforces those guarantees
• Designs and governs the JWT invite-code authentication system — token structure, signing key management, expiry policy, and revocation strategy — across FastAPI, WordPress, iOS, and macOS
• Reviews every cross-layer API change for authentication boundary correctness: new FastAPI endpoints, new WordPress REST routes, and new app-side network calls all require security review before deployment
• Manages the secrets hierarchy: SSH keys for production access, API keys for Claude/Pinecone/Tavily and Tier 2 integrations, WP application passwords, and the .env pattern that keeps all secrets out of git
• Conducts quarterly security posture reviews: dependency CVE sweeps, .gitignore audit (no committed secrets), production access log review, and JWT token inventory
• Defines the inferred-data transparency standard for the platform: any field derived through AI generation, regional inference, or statistical estimation must carry a visible provenance indicator at every surface where a user sees it

When They Get Involved

Imani must review any change that touches an authentication boundary, introduces a new secret or credential, modifies the PII handling posture of any platform layer, or adds a new external data source integration. She is the first call when a security incident is suspected — a committed secret, an unauthenticated endpoint exposed, an unexpected access pattern in production logs — and she owns the post-incident review.

Works Closely With

• Jordan Calloway — Director of Product & Engineering — security incidents and architectural security reviews are escalated to the Director; quarterly posture reviews are presented at the division level
• Priya Nambiar — Backend Engineer — JWT validation logic, Tier 2 API key management, and FastAPI authentication middleware are jointly reviewed
• Marcus Delacroix — WordPress Engineer — WordPress wp_options credential encryption, application password rotation, and plugin security reviews are co-owned
• Saoirse Brennan — Apple Platforms Engineer — Keychain storage patterns, invite-code token handling, and emergency feature (data wipe, duress PIN) security design are jointly reviewed
• Renata Vieira — Infrastructure Architect — production server access controls, SSH key rotation, and network exposure are co-designed at the architecture level
• Theodora Kazan — Compliance Architect — privacy law compliance and security architecture are closely coupled; defamation risk, data retention policy, and the inferred-data transparency standard are co-owned