Application Security Architect

Work Location: Virginia (Local Candidates Only)

Work Arrangement: Hybrid / Onsite

Initial Onsite Requirement: 4 days per week during the first 90 days

Post-Probation: Reduced onsite presence may be possible; weekly onsite attendance will still be required.

Job Summary

We are seeking an experienced Application Security Architect to define, implement, and oversee application security strategies across enterprise IT initiatives. The ideal candidate will have strong expertise in secure software architecture, threat modeling, cloud security, data protection, and DevSecOps.

This role will drive the integration of security throughout the Software Development Lifecycle (SDLC) while supporting modern web applications, AI-enabled solutions, cloud-native platforms, enterprise GIS systems, and low-code/no-code technologies. The architect will also establish data governance, privacy, and security standards to protect sensitive enterprise information and ensure compliance with applicable security requirements.

Key Responsibilities

• Define application security architecture principles, standards, reference architectures, reusable patterns, and security guardrails for web, mobile, API, microservices, and cloud-native applications.
• Conduct architecture and design reviews to identify trust boundaries, attack paths, data flows, security gaps, and appropriate mitigating controls.
• Lead threat modeling for new applications, major enhancements, integrations, and high-risk changes.
• Establish security requirements for authentication, authorization, session management, encryption, secrets management, logging, privacy, and API protection.
• Integrate security practices throughout the SDLC, including code reviews, CI/CD pipelines, infrastructure as code, security testing, release approvals, and production monitoring.
• Evaluate and implement security tools covering SAST, DAST, software composition analysis, container scanning, API security testing, secret scanning, and runtime protection.
• Establish application vulnerability management processes, remediation SLAs, risk-based prioritization, exception handling, and remediation verification.
• Assess third-party libraries, open-source dependencies, SaaS integrations, and vendor-provided components for security risks.
• Design identity and access-management solutions using least privilege, MFA, SSO, RBAC/ABAC, and privileged-access controls.
• Collaborate with cloud and platform engineering teams to secure Kubernetes, containers, serverless workloads, cloud IAM, network segmentation, and secrets storage.
• Define data protection and privacy strategies covering structured, unstructured, and spatial/GIS data.
• Implement data classification, encryption, data loss prevention (DLP), access controls, dynamic masking, and centralized audit logging.
• Support incident response, root-cause analysis, and post-incident security improvements.
• Maintain architecture documentation, security standards, risk registers, security decisions, and exception records.
• Communicate technical risks, architectural trade-offs, and remediation recommendations to engineering teams, leadership, and business stakeholders.

Required Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, Engineering, or a related field, or equivalent practical experience.
• 10+ years of experience in software engineering, application security, security engineering, or related technical roles.
• At least 2 years of experience designing security architectures for enterprise systems.
• Strong understanding of secure software development principles and OWASP Top 10 vulnerabilities, including injection, insecure authorization, deserialization, and API abuse.
• Experience designing end-to-end data security architectures across Azure, SQL Server, Dynamics 365, Power Platform, and ArcGIS.
• Hands-on knowledge of data classification and protection tools such as Microsoft Purview, encryption, DLP policies, and privacy impact assessments (DPIAs).
• Experience implementing granular data access controls, including RBAC, row-level security, column-level encryption, and dynamic data masking.
• Knowledge of centralized database auditing, activity monitoring, and security compliance standards.
• Demonstrated expertise in threat modeling, application security architecture reviews, and risk assessments.
• Experience securing APIs, web applications, distributed systems, cloud platforms, CI/CD pipelines, and containerized workloads.
• Knowledge of secure coding practices across Java, .NET, JavaScript/TypeScript, and/or Python ecosystems.
• Strong understanding of OAuth 2.0, OpenID Connect, SAML, JWT, PKI/TLS, encryption, identity management, and secrets management.
• Ability to translate complex security risks into practical recommendations for technical and nontechnical stakeholders.
• Excellent written and verbal communication skills, including architecture diagrams, security standards, risk assessments, and remediation plans.

Preferred Qualifications

• Experience working in regulated environments such as government, financial services, healthcare, or payments.
• Experience implementing DevSecOps programs and security automation at enterprise scale.
• Familiarity with privacy engineering, data classification, data governance, and relevant compliance frameworks.
• Experience with Microsoft Azure security, Microsoft Purview, Dynamics 365, Power Platform, and ArcGIS security.
• Relevant certifications such as CISSP, CSSLP, CCSP, GIAC, cloud security certifications, or vendor-specific credentials.
• Experience coordinating penetration testing and translating findings into long-term architectural improvements.

Candidate Requirements

• Local candidates only.
• Must be available to work onsite 4 days per week during the initial 90-day probationary period.
• Some weekly onsite presence will remain mandatory after the probationary period.
• Candidates should have strong communication skills and the ability to collaborate with architecture, development, infrastructure, and cybersecurity teams.

Ideal Candidate Profile

The ideal candidate is a senior security professional with a strong application-security architecture background, hands-on cloud and data protection expertise, proven threat-modeling capabilities, and experience embedding security into enterprise development practices.