Application Security Architect
for sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. We must not repeat job title as heading. No Job ID etc. Remove boilerplate like EEO, etc. Also remove application instructions. Keep all substantive info.
We need to parse the posting.
Content:
- Intro: Ampcus Inc. description, seeking candidate. Could be "About the role" maybe includes description.
- Job Title: Application Security Architect (but we don't repeat as heading). Location: Richmond, VA (Hybrid: 4 days/week on site). This could go under "Schedule" maybe? Actually schedule is about onsite days. Could be schedule.
- Description: "Seeking an Application Security Architect to define, embed, and oversee application security strategies across enterprise IT initiatives. This role will be responsible for the solution of Secure Software Development Lifecycle (SSDLC) across a hybrid ecosystem, spanning complex web applications, Agentic AI solutions, cloud-native solutions, enterprise GIS platforms, low-code no-code and create patterns. Lead the data protection strategy, data governance frameworks, and privacy posture across a state-wide transportation ecosystem. Define how structured, unstructured, and spatial data (GIS) are classified, encrypted, stored, and accessed across cloud data platforms. Support architecture, development, and cybersecurity teams to perform threat modeling, secure architectural designs and ensure compliance with Commonwealth of Virginia (COV) and VITA security standards."
That's description.
- Bachelor’s degree ... required. Certifications ... highly desired.
- Core Responsibilities: list bullet points.
- Required Qualifications: bullet list.
- Preferred Qualifications: bullet list.
- Additional Information: Local candidates only please. Candidate must be able to work onsite 4 days/week during an initial 90-day probationary period; there is a possibility of reduced onsite commitment after successful probation, though some onsite presence will continue to be required weekly.
- EEO boilerplate to remove.
Thus sections:
About the role: could include intro description and maybe location? Usually About the role includes description of role, location, maybe summary.
Responsibilities: the Core Responsibilities list.
Requirements: maybe combine Required Qualifications and Preferred? But we have separate sections: Requirements and Qualifications. The instruction says use headings for sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. So we need to map content accordingly.
We have:
- About the role: description paragraph(s) plus maybe location? Could include location as part of About.
- Responsibilities: the Core Responsibilities bullet list.
- Requirements: maybe the Required Qualifications (Bachelor's degree, 10+ years experience, etc.) Could also include certifications highly desired? That could be under Qualifications? Actually Qualifications could be preferred qualifications? But we have both Requirements and Qualifications headings. We need to decide what goes where. Typically Requirements = mandatory qualifications; Qualifications = preferred or additional qualifications. Skills could be separate list of skills (like secure coding, threat modeling, etc.) but we might incorporate into Requirements/Qualifications.
Given the instruction: "Prefer a few substantive sections over many thin ones." So we might combine some.
We need to include sections only when posting has real specific content. So we need to see if we have content for Benefits, Pay, Schedule. Benefits: none mentioned. Pay: none. Schedule: we have onsite requirement 4 days/week, probation period. That's schedule info. So we can include Schedule section with that detail.
Skills: we could list technical skills like secure coding languages, threat modeling, etc. But many of those appear in Requirements/Qualifications. Might be better to put them under Skills. However we need to avoid duplication. The instruction says preserve ALL substantive information; do not invent or summarize away detail. So we need to keep all info, but we can organize it under appropriate headings without losing detail.
We could have:
- About the role: includes introductory paragraph, location, maybe hybrid schedule? But schedule is separate.
- Responsibilities: bullet list of core responsibilities.
- Requirements: bullet list of required qualifications (Bachelor's degree, 10+ years experience, etc.) plus maybe certifications highly desired? Could be under Qualifications.
- Qualifications: bullet list of preferred qualifications (regulated environment experience, DevSecOps, privacy engineering, certifications, penetration testing).
- Skills: maybe list specific technical skills: secure software development principles, OWASP Top 10, threat modeling, secure coding in Java/.NET/JS/TS/Python, identity/OAuth/OIDC/SAML/JWT, PKI/TLS, encryption, secrets management, etc. But many of these appear in Required Qualifications and Preferred Qualifications. To avoid duplication, we could place them under Skills and not repeat elsewhere. However we must preserve all info; if we move them to Skills and not include them elsewhere, that's fine as long as we keep the info. But we need to ensure we don't lose any info like "Bachelor's degree required" etc. Those are not skills but qualifications.
Thus we can allocate:
About the role: description paragraph(s) + location (Richmond, VA Hybrid 4 days/week on site). Could also mention "Local candidates only please." but that's more about eligibility; maybe under Additional Information but we could put under About the role or Schedule? Probably better to put under Additional Information but we don't have a heading for that. Could fold into About the role or Schedule. Since we have Schedule heading, we can put onsite requirement there. Local candidates only could be a note under About the role.
Responsibilities: bullet list from Core Responsibilities.
Requirements: bullet list from Required Qualifications (Bachelor's degree, 10+ years experience, strong understanding of secure software-development principles, OWASP Top 10, etc., ability to explain technical risks, strong written communication skills). Also maybe "Experience securing APIs, web applications, distributed systems, cloud platforms, CI/CD pipelines, containerized workloads." etc. Those are part of Required Qualifications.
Qualifications: bullet list from Preferred Qualifications (regulated environment experience, DevSecOps programs, privacy engineering, certifications, penetration testing experience).
Skills: maybe we could list specific technical skills like "Secure coding in Java, .NET, JavaScript/TypeScript, Python; Identity/OAuth 2.0, OpenID Connect, SAML, JWT; PKI/TLS; encryption; secrets management; threat modeling; architecture reviews; data classification; encryption; DLP; RBAC; etc." But many of these are already in Requirements/Qualifications. To avoid duplication, we could decide not to have a Skills section and instead put those details under Requirements and Qualifications. The instruction says we can have sections for Skills, but we don't have to if we prefer fewer sections. So we could omit Skills if we think it's thin. However we have a lot of skill-like details; but they are already captured. So we can omit Skills.
Benefits: none -> omit.
Pay: none -> omit.
Schedule: we have onsite 4 days/week during probation, possibility of reduced after probation, some onsite presence continues weekly. Also location hybrid. So we can put that.
Thus final sections: About the role, Responsibilities, Requirements, Qualifications, Schedule.
Now we need to format with headings, - for lists,
for prose.
We must not include any boilerplate like EEO, etc. Also remove duplicated lines.
Let's extract precise text.
About the role prose:
From intro: "Ampcus Inc. is a certified global provider of a broad range of Technology and Business consulting services. We are in search of a highly motivated candidate to join our talented Team." Then location: "Job Title: Application Security Architect Location(s): Richmond, VA (Hybrid: 4 days/week on site)". Then Description paragraph: "Seeking an Application Security Architect to define, embed, and oversee application security strategies across enterprise IT initiatives. This role will be responsible for the solution of Secure Software Development Lifecycle (SSDLC) across a hybrid ecosystem, spanning complex web applications, Agentic AI solutions, cloud-native solutions, enterprise GIS platforms, low-code no-code and create patterns. Lead the data protection strategy, data governance frameworks, and privacy posture across a state-wide transportation ecosystem. Define how structured, unstructured, and spatial data (GIS) are classified, encrypted, stored, and accessed across cloud data platforms. Support architecture, development, and cybersecurity teams to perform threat modeling, secure architectural designs and ensure compliance with Commonwealth of Virginia (COV) and VITA security standards."
We could combine into a few paragraphs.
We should not repeat the job title as heading, but we can include it in prose.
Local candidates only please: that's a note; we could add to About the role or Schedule. Probably About the role.
Thus About the role prose could be:
Ampcus Inc. is a certified global provider of a broad range of Technology and Business consulting services. We are in search of a highly motivated candidate to join our talented Team.
Location: Richmond, VA (Hybrid: 4 days/week on site). Local candidates only please.
Seeking an Application Security Architect to define, embed, and oversee application security strategies across enterprise IT initiatives. This role will be responsible for the solution of Secure Software Development Lifecycle (SSDLC) across a hybrid ecosystem, spanning complex web applications, Agentic AI solutions, cloud-native solutions, enterprise GIS platforms, low-code no-code and create patterns. Lead the data protection strategy, data governance frameworks, and privacy posture across a state-wide transportation ecosystem. Define how structured, unstructured, and spatial data (GIS) are classified, encrypted, stored, and accessed across cloud data platforms. Support architecture, development, and cybersecurity teams to perform threat modeling, secure architectural designs and ensure compliance with Commonwealth of Virginia (COV) and VITA security standards.
That seems good.
Now Responsibilities: list bullet points from "Core Responsibilities". Let's extract each bullet:
- Define application-security architecture principles, standards, patterns, reference implementations, and guardrails for web, mobile, API, microservice, and cloud-native systems.
- Perform architecture and design reviews, identify trust boundaries, attack paths, data flows, security gaps, and compensating controls.
- Lead or facilitate threat modeling for new applications, major features, integrations, and high-risk changes.
- Establish repeatable security requirements for authentication, authorization, session management, encryption, secrets management, logging, privacy, API protection, and data protection.
- Partner with software engineers to integrate security throughout the SDLC, including code review, CI/CD pipelines, infrastructure as code, testing, release approval, and production monitoring.
- Evaluate and guide use of security tools such as SAST, DAST, software composition analysis, container/image scanning, API security testing, secret scanning, and runtime protection.
- Define a vulnerability-management approach for applications and dependencies, including severity criteria, remediation SLAs, exception processes, and verification of fixes.
- Assess third-party libraries, open-source dependencies, SaaS integrations, and vendor-provided components for security risk.
- Design identity and access-control patterns, including least privilege, MFA/SSO integration, service-to-service authentication, RBAC/ABAC, and privileged-access controls.
- Work with cloud and platform teams to secure application hosting environments, including Kubernetes, serverless, containers, CI/CD, cloud IAM, network segmentation, and secrets storage.
- Advise incident-response teams on application-layer threats and contribute to root-cause analysis and security improvements after incidents.
- Maintain architecture documentation, security decision patterns, risk registers, and exception documentation.
We'll put each as - .
Now Requirements: from "Required Qualifications". Let's extract:
- Bachelor’s degree in computer science, cybersecurity, engineering, or a related field (or equivalent practical experience) is required.
- Certifications such as CISSP, CSSLP, CCSP, GIAC, or relevant vendor credentials are highly desired. (This is under Required Qualifications? Actually it's after Bachelor's degree line: "Bachelor’s degree ... is required. Certifications such as CISSP, CSSLP, CCSP, GI
- for lists,
for prose. We must not include any boilerplate like EEO, etc. Also remove duplicated lines. Let's extract precise text. About the role prose: From intro: "Ampcus Inc. is a certified global provider of a broad range of Technology and Business consulting services. We are in search of a highly motivated candidate to join our talented Team." Then location: "Job Title: Application Security Architect Location(s): Richmond, VA (Hybrid: 4 days/week on site)". Then Description paragraph: "Seeking an Application Security Architect to define, embed, and oversee application security strategies across enterprise IT initiatives. This role will be responsible for the solution of Secure Software Development Lifecycle (SSDLC) across a hybrid ecosystem, spanning complex web applications, Agentic AI solutions, cloud-native solutions, enterprise GIS platforms, low-code no-code and create patterns. Lead the data protection strategy, data governance frameworks, and privacy posture across a state-wide transportation ecosystem. Define how structured, unstructured, and spatial data (GIS) are classified, encrypted, stored, and accessed across cloud data platforms. Support architecture, development, and cybersecurity teams to perform threat modeling, secure architectural designs and ensure compliance with Commonwealth of Virginia (COV) and VITA security standards." We could combine into a few paragraphs. We should not repeat the job title as heading, but we can include it in prose. Local candidates only please: that's a note; we could add to About the role or Schedule. Probably About the role. Thus About the role prose could be:
Ampcus Inc. is a certified global provider of a broad range of Technology and Business consulting services. We are in search of a highly motivated candidate to join our talented Team.
Location: Richmond, VA (Hybrid: 4 days/week on site). Local candidates only please.
Seeking an Application Security Architect to define, embed, and oversee application security strategies across enterprise IT initiatives. This role will be responsible for the solution of Secure Software Development Lifecycle (SSDLC) across a hybrid ecosystem, spanning complex web applications, Agentic AI solutions, cloud-native solutions, enterprise GIS platforms, low-code no-code and create patterns. Lead the data protection strategy, data governance frameworks, and privacy posture across a state-wide transportation ecosystem. Define how structured, unstructured, and spatial data (GIS) are classified, encrypted, stored, and accessed across cloud data platforms. Support architecture, development, and cybersecurity teams to perform threat modeling, secure architectural designs and ensure compliance with Commonwealth of Virginia (COV) and VITA security standards.
That seems good. Now Responsibilities: list bullet points from "Core Responsibilities". Let's extract each bullet: - Define application-security architecture principles, standards, patterns, reference implementations, and guardrails for web, mobile, API, microservice, and cloud-native systems. - Perform architecture and design reviews, identify trust boundaries, attack paths, data flows, security gaps, and compensating controls. - Lead or facilitate threat modeling for new applications, major features, integrations, and high-risk changes. - Establish repeatable security requirements for authentication, authorization, session management, encryption, secrets management, logging, privacy, API protection, and data protection. - Partner with software engineers to integrate security throughout the SDLC, including code review, CI/CD pipelines, infrastructure as code, testing, release approval, and production monitoring. - Evaluate and guide use of security tools such as SAST, DAST, software composition analysis, container/image scanning, API security testing, secret scanning, and runtime protection. - Define a vulnerability-management approach for applications and dependencies, including severity criteria, remediation SLAs, exception processes, and verification of fixes. - Assess third-party libraries, open-source dependencies, SaaS integrations, and vendor-provided components for security risk. - Design identity and access-control patterns, including least privilege, MFA/SSO integration, service-to-service authentication, RBAC/ABAC, and privileged-access controls. - Work with cloud and platform teams to secure application hosting environments, including Kubernetes, serverless, containers, CI/CD, cloud IAM, network segmentation, and secrets storage. - Advise incident-response teams on application-layer threats and contribute to root-cause analysis and security improvements after incidents. - Maintain architecture documentation, security decision patterns, risk registers, and exception documentation. We'll put each as - . Now Requirements: from "Required Qualifications". Let's extract: - Bachelor’s degree in computer science, cybersecurity, engineering, or a related field (or equivalent practical experience) is required. - Certifications such as CISSP, CSSLP, CCSP, GIAC, or relevant vendor credentials are highly desired. (This is under Required Qualifications? Actually it's after Bachelor's degree line: "Bachelor’s degree ... is required. Certifications such as CISSP, CSSLP, CCSP, GI