Application & Platform Security Architect

What you'll do

• Define reusable security architecture patterns and guardrails to ensure consistent implementation across high-risk business applications.
• Integrate security considerations early in the software architecture lifecycle to drive secure-by-design initiatives.
• Represent security architecture in design authority boards and technical review councils to advocate for risk-based controls.
• Evaluate application software and infrastructure designs with IT customers to define controls aligned with enterprise standards.
• Develop reusable implementation guidance and design patterns based on previous engagements to scale security services.
• Perform application threat modeling to identify potential threats and propose design changes to mitigate risks.
• Research, evaluate, and plan the implementation of new or updated information security technologies.
• Advise on project requirements to ensure security controls are implemented as planned and remediate any identified gaps.

What we're looking for

• Bachelor’s degree and 9 years of experience, Master’s and 8 years, or PhD and 4 years in information security or related functions.
• Strong understanding of application security principles including OWASP Top 10, SANS/CWE Top 25, and secure coding practices.
• Expertise in session management, token handling, and authentication mechanisms such as OAuth, SAML, and OpenID Connect.
• Knowledge of cryptographic practices, encryption protocols, and PKI management.
• Experience with containerization (Docker, Kubernetes) and cloud platforms (AWS, Azure, GCP).
• Familiarity with code analysis tools like SonarQube or Veracode and vulnerability scanners like Burp Suite or Nessus.
• Significant SOX and HIPAA experience dealing with IT general controls through audit, remediation, or system validation.
• Information security qualifications such as CISSP (preferred).