Application Security Architect

Application Security Architect

Location: Richmond, Virginia



Duration: 10 Months



Work Arrangement: Hybrid



Interview: Web Cam + In-Person



Local Candidates Only Work Arrangement

The selected candidate must be able to work onsite 4 days per week during the initial 90-day probationary period . Following successful completion of the probationary period, there may be an opportunity for a reduced onsite schedule; however, some weekly onsite presence will continue to be required.

Position Overview

We are seeking an experienced Application Security Architect to define, implement, and oversee application security strategies across enterprise IT initiatives.

The Application Security Architect will establish and mature Secure Software Development Lifecycle (SSDLC) practices across a hybrid technology ecosystem that includes complex web applications, APIs, microservices, cloud-native solutions, AI-enabled applications, enterprise GIS platforms, and low-code/no-code technologies.

This role will also lead data protection, data governance, privacy, and security architecture initiatives. The successful candidate will define how structured, unstructured, and spatial/GIS data are classified, encrypted, stored, accessed, monitored, and protected across enterprise cloud and data platforms.

The architect will partner closely with application development, infrastructure, cloud, data, and cybersecurity teams to conduct threat modeling, perform secure architecture reviews, establish security standards, and ensure applications and platforms follow applicable security and compliance requirements.

Core Responsibilities

• Define application security architecture principles, standards, patterns, reference architectures, and security guardrails for web, mobile, API, microservice, and cloud-native applications.

• Perform architecture and design reviews to identify trust boundaries, attack paths, data flows, security gaps, risks, and appropriate compensating controls.

• Lead and facilitate threat-modeling activities for new applications, major features, integrations, and high-risk technology changes.

• Establish repeatable security requirements covering authentication, authorization, session management, encryption, secrets management, logging, privacy, API protection, and data security.

• Partner with software engineering teams to integrate security throughout the SDLC, including secure code reviews, CI/CD pipelines, infrastructure as code, security testing, release approvals, and production monitoring.

• Evaluate and guide the implementation of security tools and processes, including SAST, DAST, software composition analysis, container/image scanning, API security testing, secret scanning, and runtime application protection.

• Establish and maintain an application vulnerability-management strategy, including severity criteria, remediation SLAs, exception processes, risk acceptance, and verification of remediation.

• Assess third-party libraries, open-source dependencies, SaaS integrations, and vendor-provided components for security and supply-chain risks.

• Design identity and access-management patterns incorporating least privilege, MFA, SSO, service-to-service authentication, RBAC, ABAC, and privileged-access controls.

• Work with cloud and platform teams to secure application hosting environments, including Kubernetes, serverless platforms, containers, CI/CD infrastructure, cloud IAM, network segmentation, and secrets-management solutions.

• Define and implement security architectures for data at rest, in transit, and in use across enterprise cloud, database, CRM, productivity, low-code/no-code, and GIS platforms.

• Establish data classification, encryption, DLP, privacy, and data-protection controls for sensitive enterprise information.

• Implement granular data-access controls, including RBAC, row-level security, column-level encryption, dynamic data masking, database auditing, and activity monitoring.

• Establish centralized security logging and monitoring capabilities for applications, databases, APIs, and cloud environments.

• Advise incident-response teams on application-layer security threats and participate in root-cause analysis following security incidents.

• Maintain application-security architecture documentation, security decision records, architecture diagrams, risk registers, security standards, and exception documentation.

• Communicate security risks, architectural tradeoffs, and remediation strategies effectively to engineers, technical leadership, product teams, executives, and nontechnical stakeholders.

Required Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, Engineering, or a related field, or equivalent practical experience.

• 10+ years of experience in software engineering, application security, security engineering, or related technical roles.

• 6+ years of experience designing and implementing security architecture for IT systems.

• 6+ years of experience applying secure software-development principles and addressing common application security risks, including OWASP Top 10, insecure authorization, injection, deserialization, and API abuse.

• 6+ years of experience designing and implementing end-to-end security architectures for data at rest, in transit, and in use across Microsoft technologies such as Azure, Microsoft 365, Power Platform, Dynamics 365, and SQL Server .

• 6+ years of demonstrated experience with threat modeling and security architecture reviews.

• 6+ years of experience securing APIs, web applications, distributed systems, cloud platforms, CI/CD pipelines, and containerized workloads.

• Strong understanding of secure coding practices in one or more common technology ecosystems, including Java, .NET, JavaScript/TypeScript, or Python .

• Strong experience with identity and access-management technologies and protocols, including OAuth 2.0, OpenID Connect, SAML, JWT, RBAC/ABAC, PKI/TLS, encryption, and secrets management .

• Experience with data classification, encryption, DLP, privacy risk assessments, database security, and data-access controls.

• Ability to analyze security architecture and identify vulnerabilities, attack paths, trust boundaries, and appropriate mitigation strategies.

• Strong written and verbal communication skills.

• Ability to create and maintain architecture diagrams, security standards, risk assessments, security documentation, and actionable remediation plans.

• Ability to communicate complex technical security risks and tradeoffs to both technical and nontechnical stakeholders.

Preferred Qualifications

• Experience working in regulated environments such as financial services, healthcare, government, insurance, or payments .

• Experience implementing DevSecOps programs and security automation at scale .

• Familiarity with privacy engineering, data classification, data governance, and compliance frameworks.

• Experience with security architecture and security controls within Esri ArcGIS or other enterprise GIS platforms.

• Experience conducting or coordinating penetration testing and translating findings into sustainable architectural and security improvements.

• Experience with cloud-security architecture and security automation.

• Certifications such as CISSP, CSSLP, CCSP, GIAC , or relevant cloud/vendor security certifications.

Skill Matrix

Skill Required / Desired Minimum Experience

Software engineering, application security, security engineering, or related technical roles	Required	10 Years
Designing and implementing security architecture for IT systems	Required	6 Years
Secure software-development principles and application risks, including OWASP Top 10, authorization, injection, deserialization, and API abuse	Required	6 Years
End-to-end security architecture across Azure, Microsoft 365, Power Platform, Dynamics 365, and SQL Server	Required	6 Years
Threat modeling and security architecture reviews	Required	6 Years
Securing APIs, web applications, distributed systems, cloud platforms, CI/CD pipelines, and containerized workloads	Required	6 Years
Identity, OAuth 2.0, OpenID Connect, SAML, JWT, authorization, PKI/TLS, encryption, and secrets management	Required	6 Years
Security architecture documentation, diagrams, standards, risk assessments, and remediation plans	Required	10 Years
Experience in regulated environments such as financial services, healthcare, government, or payments	Highly Desired	6 Years
Penetration testing coordination and translating findings into architectural improvements	Highly Desired	6 Years
DevSecOps programs and security automation at scale	Highly Desired	4 Years
Privacy engineering, data classification, and compliance frameworks	Highly Desired	4 Years
Security architecture experience with Esri ArcGIS or enterprise GIS platforms	Highly Desired	2 Years