Application Security Architect

Job Overview:

Pay Range: $90.00hr - $95.00hr

Requirement/Must Have:

• Software engineering, application security, security engineering, or related technical roles.
• Experience in designing and implementing security architecture for IT systems.
• Secure software-development principles and common risks, including the OWASP Top 10, insecure authorization, injection, deserialization and API abuse.
• Design and implement end-to-end security architectures for data-at-rest, in-transit, and in-use for full MS stack (Azure, O365, Power Platform, D365).
• Demonstrated experience with threat modeling and security architecture reviews.
• Experience securing APIs, web applications, distributed systems, cloud platforms, CI/CD pipelines, and containerized workloads.
• Experience with identity, OAuth 2.0, OpenID Connect, SAML, JWTs, authorization design, PKI/TLS, encryption, and secrets-management practices.
• Strong written communication skills, including ability to create architecture diagrams, standards, risk assessments, and actionable remediation plans.
• Experience in a regulated environment such as financial services, healthcare, government, or payments.
• Experience conducting or coordinating penetration testing and translating results into durable architectural improvements.
• Experience implementing DevSecOps programs and security automation at scale.
• Familiarity with privacy engineering, data classification, and compliance frameworks.
• Experience with security architectures in Esri's ArcGIS platform.
• Working knowledge of secure coding in one or more common ecosystems, such as Java, .NET, JavaScript/TypeScript, Python platforms.
• Ability to explain technical risks and tradeoffs clearly to engineers, product managers, executives, and nontechnical stakeholders.

Responsibilities:

• Define application-security architecture principles, standards, patterns, reference implementations, and guardrails for web, mobile, API, microservice, and cloud-native systems.
• Perform architecture and design reviews, identify trust boundaries, attack paths, data flows, security gaps, and compensating controls.
• Lead or facilitate threat modeling for new applications, major features, integrations, and high-risk changes.
• Establish repeatable security requirements for authentication, authorization, session management, encryption, secrets management, logging, privacy, API protection, and data protection.
• Partner with software engineers to integrate security throughout the SDLC, including code review, CI/CD pipelines, infrastructure as code, testing, release approval, and production monitoring.
• Evaluate and guide use of security tools such as SAST, DAST, software composition analysis, container/image scanning, API security testing, secret scanning, and runtime protection.
• Define a vulnerability-management approach for applications and dependencies, including severity criteria, remediation SLAs, exception processes, and verification of fixes.
• Assess third-party libraries, open-source dependencies, SaaS integrations, and vendor-provided components for security risk.
• Design identity and access-control patterns, including least privilege, MFA/SSO integration, service-to-service authentication, RBAC/ABAC, and privileged-access controls.
• Work with cloud and platform teams to secure application hosting environments, including Kubernetes, serverless, containers, CI/CD, cloud IAM, network segmentation, and secrets storage.
• Advise incident-response teams on application-layer threats and contribute to root-cause analysis and security improvements after incidents.
• Maintain architecture documentation, security decision patterns, risk registers, and exception documentation.
• Lead the data protection strategy, data governance frameworks, and privacy posture across the organization.
• Define how structured, unstructured, and spatial data (GIS) are classified, encrypted, stored, and accessed across cloud data platforms.
• Support architecture, development, and cybersecurity teams to perform threat modeling, secure architectural designs and ensure compliance with security standards.
• Enforce granular data access controls including RBAC, Row-Level Security, Column-Level Encryption, and dynamic masking.
• Establish centralized database audit logging and activity monitoring pipelines to ensure strict alignment with security standards.

Nice to Have:

• Certifications such as CISSP, CSSLP, CCSP, GIAC, cloud-security certifications, or relevant vendor credentials.

Skills:

• Azure.
• O365.
• Power Platform.
• Dynamics 365.
• ArcGIS.
• SQL Server.
• OWASP Top 10.
• OAuth 2.0.
• OpenID Connect.
• SAML.
• JWT.
• PKI/TLS.
• SAST.
• DAST.
• CI/CD.
• Kubernetes.
• Java.
• .NET.
• JavaScript.
• TypeScript.
• Python.

Qualification And Education:

• Bachelor's degree in computer science, cybersecurity, engineering, or a related field or equivalent practical experience.
• 10+ years in software engineering, application security, security engineering, or related technical roles.
• 2+ years designing security architecture for systems.