Application & Platform Security Architect

What you'll do

• Define reusable security architecture patterns and guardrails to ensure consistent, secure implementation across high-risk business applications.
• Integrate security considerations early in the software architecture lifecycle to drive secure-by-design initiatives.
• Represent security architecture in design authority boards and technical review councils to advocate for risk-based controls.
• Evaluate application software and infrastructure designs with IT customers to define controls aligned with enterprise standards.
• Develop reusable implementation guidance and design patterns based on previous engagements to scale security services.
• Research, evaluate, and plan the implementation of new or updated information security technologies.
• Perform application threat modeling to identify potential threats and propose design changes to mitigate risks.
• Collaborate with software development and DevOps teams to integrate security into the software development lifecycle.

What we're looking for

• Bachelor’s degree and 9 years of experience, Master’s degree and 8 years of experience, or PhD and 4 years of experience in information security or related functions.
• In-depth knowledge of the systems development life cycle, client area functions, and systems applications programs development technological alternatives.
• Strong understanding of application security principles, including OWASP Top 10, SANS/CWE Top 25, and secure coding practices.
• Expertise in secure session management, token handling, and authentication mechanisms such as OAuth, SAML, and OpenID Connect.
• Knowledge of cryptographic practices, encryption protocols, and PKI management.
• Experience with containerization (Docker, Kubernetes) and cloud platforms (AWS, Azure, GCP).
• Familiarity with tools for code analysis (e.g., SonarQube, Veracode) and vulnerability scanning (e.g., Burp Suite, Nessus).
• Understanding of DevSecOps practices, including securing CI/CD pipelines.
• Advanced knowledge of Identity Security concepts, least-privilege, separation of duties, and Zero trust design principles.
• Significant SOX and HIPAA experience in dealing with IT general controls (ITGC) through hands-on audit, remediation, and/or computer system validation.
• Thorough understanding of Information Security frameworks and good practices, such as ISO and NIST.
• Information security qualifications such as CISSP (preferred).