Application & Platform Security Architect

What you'll do

• Define reusable security architecture patterns and guardrails to ensure consistent, secure implementation across high-risk business applications.
• Integrate security considerations early in the software architecture lifecycle to drive secure-by-design initiatives.
• Represent security architecture in design authority boards and technical review councils to advocate for risk-based controls.
• Evaluate application software and infrastructure designs with IT customers to define controls aligned with enterprise standards.
• Produce design artifacts and implementation guidance to guide the secure deployment of business-critical systems.
• Research, evaluate, and plan the implementation of new information security technologies and remedial actions for identified threats.
• Perform application threat modeling to identify potential risks and propose design changes for mitigation.
• Collaborate with DevOps and engineering teams to embed security principles into the software development lifecycle.

What we're looking for

• Bachelor’s degree and 9 years of experience, Master’s and 8 years, or PhD and 4 years in information security or related functions.
• In-depth knowledge of the systems development life cycle, client area functions, and systems applications programs development.
• Strong understanding of application security principles, including OWASP Top 10, SANS/CWE Top 25, and secure coding practices.
• Expertise in secure session management, token handling, and authentication mechanisms like OAuth, SAML, and OpenID Connect.
• Experience with containerization (Docker, Kubernetes), cloud platforms (AWS, Azure, GCP), and DevSecOps practices.
• Knowledge of cryptographic practices, encryption protocols, PKI management, and federation technologies.
• Significant SOX and HIPAA experience dealing with IT general controls through hands-on audit, remediation, and computer system validation.
• Information security qualifications such as CISSP (preferred).