Application Security Architect

Job Summary


VDOT is seeking an Application Security Architect to define, embed, and oversee application security strategies across enterprise IT initiatives.


This role will be responsible for the Secure Software Development Lifecycle (SSDLC) across a hybrid ecosystem spanning complex web applications, Agentic AI solutions, cloud-native solutions, enterprise GIS platforms, and low-code/no-code patterns.


The role will also lead data protection strategy, data governance frameworks, and privacy posture across the statewide transportation ecosystem. The architect will work with architecture, development, and cybersecurity teams to perform threat modeling, develop secure architectural designs, and ensure compliance with Commonwealth of Virginia (COV) and VITA security standards.

Core Responsibilities

• Define application-security architecture principles, standards, patterns, reference implementations, and guardrails for web, mobile, API, microservice, and cloud-native systems.
• Perform architecture and design reviews, identifying trust boundaries, attack paths, data flows, security gaps, and compensating controls.
• Lead or facilitate threat modeling for new applications, major features, integrations, and high-risk changes.
• Establish security requirements for authentication, authorization, session management, encryption, secrets management, logging, privacy, API protection, and data protection.
• Partner with software engineers to integrate security throughout the SDLC, including code review, CI/CD pipelines, infrastructure as code, testing, release approval, and production monitoring.
• Evaluate and guide security tools such as SAST, DAST, software composition analysis, container/image scanning, API security testing, secret scanning, and runtime protection.
• Define a vulnerability-management approach for applications and dependencies, including severity criteria, remediation SLAs, exception processes, and verification of fixes.
• Assess third-party libraries, open-source dependencies, SaaS integrations, and vendor-provided components for security risk.
• Design identity and access-control patterns, including least privilege, MFA/SSO integration, service-to-service authentication, RBAC/ABAC, and privileged-access controls.
• Work with cloud and platform teams to secure application hosting environments, including Kubernetes, serverless, containers, CI/CD, cloud IAM, network segmentation, and secrets storage.
• Advise incident-response teams on application-layer threats and contribute to root-cause analysis and security improvements after incidents.
• Maintain architecture documentation, security decision patterns, risk registers, and exception documentation.

Required Qualifications

• Bachelor's degree in computer science, cybersecurity, engineering, or a related field, or equivalent practical experience.
• 10+ years in software engineering, application security, security engineering, or related technical roles, including 2+ years designing security architecture for systems.
• Strong understanding of secure software-development principles and common application risks, including OWASP Top 10, insecure authorization, injection, deserialization, and API abuse.
• Experience designing and implementing end-to-end security architectures for data-at-rest, in-transit, and in-use across Azure, SQL Server, Dynamics 365, Power Platform, and ArcGIS platforms.
• Experience utilizing automated classification such as Microsoft Purview, encryption, DLP rules, and privacy risk assessments (DPIAs).
• Experience enforcing granular data access controls, including RBAC, Row-Level Security, Column-Level Encryption, and dynamic masking.
• Experience establishing centralized database audit logging and activity monitoring pipelines aligned with VITA SEC 530 security standards.
• Demonstrated experience with threat modeling and security architecture reviews.
• Experience securing APIs, web applications, distributed systems, cloud platforms, CI/CD pipelines, and containerized workloads.
• Working knowledge of secure coding in one or more ecosystems such as Java, .NET, JavaScript/TypeScript, or Python.
• Experience with identity, OAuth 2.0, OpenID Connect, SAML, JWTs, authorization design, PKI/TLS, encryption, and secrets-management practices.
• Ability to e