Application Security Architect

This is a remote position.

Role Overview

The Application Security Architect is responsible for assessing and securing the organization's software development lifecycle (SDLC). This role bridges the gap between enterprise security

policy and engineering execution, ensuring that applications are secure by design, resilient to threats, and compliant with regulatory standards.

As an AppSec Architect, you will design secure architecture patterns, establish threat modeling frameworks, implement automated security guardrails within CI/CD pipelines, and serve as a trusted advisor to engineering teams.

Key Responsibilities

Security Architecture & Design

Define AA Tech secure coding standards, architectural blueprints, and security patterns (e.g., identity/auth, cryptography, data

protection).

Threat Modeling

Lead and scale product platform-level threat modeling practices across product engineering teams during the early design phases to identify and

mitigate architectural flaws.

DevSecOps Integration

Architect, deploy, and optimize automated security testing tools (SAST, DAST, SCA, IAST) directly into code repositories and CI/CD pipelines,

ensuring low friction and high fidelity for developer workflows.

Vulnerability Management

Establish governance for triage, prioritization, and remediation of software vulnerabilities, providing engineering teams with clear, actionable mitigation guidance.

Developer Enablement & Training

Cultivate a security-first culture by leading developer-centric training programs, driving a "Security Champions" network, and creating self-service security components.

Compliance & Risk Management

Ensure applications comply with relevant industry frameworks and legal requirements (e.g., OWASP Top 10, ASVS, NIST, ISO 27001, SOC 2, HIPAA).

Incident Response Support

Provide deep technical expertise during application-layer security incidents.

Required Technical Skills & Qualifications

Experience

8+ years of experience in software engineering, cybersecurity, or DevOps, with at least 4+ years dedicated explicitly to Application Security Architecture.

Secure Engineering

Deep understanding of modern application architectures (Microservices, Cloud-Native, Serverless, API-first design) and modern development frameworks.

Cloud Security

Proven experience securing applications hosted in major cloud environments (AWS, Azure, or GCP), including container security (Kubernetes) and Infrastructure as Code (IaC) scanning.

Tooling Expertise

Hands-on experience scaling and tuning DevSecOps tooling (e.g., Github Advanced Security, Snyk, SonarQube, Checkov, Veracode).

Cryptography & Protocols

Strong grasp of encryption standards, TLS, OAuth 2.0, OIDC, SAML, and secure key management.

Education/Certifications

Bachelor’s degree in Computer Science, Cybersecurity, or equivalent practical experience. Relevant certifications (e.g., CSSLP, CISSP, AWS

Certified Security, CASE) are highly preferred.

Core Competencies & Soft Skills

Pragmatic Collaboration

Ability to balance rigorous security requirements with business velocity, viewing engineering teams as customers rather than blockers.

Influential Leadership

Strong communication skills with the ability to articulate complex security risks to non-technical business stakeholders, executives, and

developers alike.

Analytical Problem Solving

Exceptional capability to dissect complex software ecosystems, anticipate emerging threat vectors, and design elegant, scalable defenses.

What Success Looks Like in This Role

Shift Left

Security is seamlessly baked into the design phase, drastically reducing the discovery of critical vulnerabilities in production.

Developer Autonomy

Engineers have clear, self-service security patterns and automated feedback loops, minimizing friction and security debt.

Application Security Governance

Validating and verifying security implementation across the product.

Measurable Risk Reduction

Transparent metrics (e.g., MTTR for critical flaws, reduction in repetitive vulnerability types) demonstrate a steadily shrinking application attack surface.

Top 3-5 skills

• Experience: 8+ years of experience in software engineering, cybersecurity, or DevOps, with at least 4+ years dedicated explicitly to Application Security Architecture.
• Secure Engineering: Deep understanding of modern application architectures (Microservices, Cloud-Native, Serverless, API-first design) and modern development frameworks including Subject-Matter Expertise in Threat Modeling.
• Cloud Security: Proven experience securing applications hosted in major cloud environments (AWS, Azure, or GCP), including container security (Kubernetes) and Infrastructure as Code (IaC) scanning.
• Tooling Expertise: Hands-on experience scaling and tuning DevSecOps tooling (e.g., Github Advanced Security, Snyk, SonarQube, Checkov, Veracode).
• Cryptography & Protocols: Strong grasp of encryption standards, TLS, OAuth 2.0, OIDC, SAML, and secure key management.
• Education/Certifications: Bachelor’s degree in Computer Science, Cybersecurity, or equivalent practical experience. Relevant certifications (e.g., CSSLP, CISSP, AWS Certified Security, CASE) are highly preferred