Lead Security Architect (Application Security)

We need to output only HTML fragment, no html/body tags, no markdown fences. Use

for section headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We must include sections only when posting has real specific content. We need to parse the posting. Content: - "About this role: Wells Fargo is seeking a Lead Systems Architect - Application Security to join the Security Architecture organization. This role will provide security architecture leadership across application development, APIs, DevSecOps, and emerging technologies, helping teams build secure-by-design solutions at enterprise scale." That's about the role. - Then "In this role, you will:" followed by bullet list of responsibilities. Many lines repeated: "Lead the implementation of complex projects and initiatives that have companywide scope" appears twice. We need to preserve all substantive info, but we can deduplicate? The instruction: "Preserve ALL substantive information; do NOT invent or summarize away detail." Duplicated lines are still substantive but duplicate; we might keep both? Usually we should keep as is, but could be considered duplication. I'd keep each line as separate

but note duplicate. However we can keep both; it's not invented. List of responsibilities: Lead the implementation of complex projects and initiatives that have companywide scope (twice) Drive secure-by-design practices across applications, APIs, cloud-native platforms, and AI-enabled solutions Assist in the creation of architectural artifacts including standards, reference architectures, design patterns, and security requirements Participate in the definition of future technology architecture and Application Security strategy Identify medium to high architectural impact projects and provide security architecture guidance throughout the project lifecycle Conduct complex technology, security, and system assessments for architecture solutions Perform threat modeling, architecture reviews, and risk assessments for critical applications and platforms Provide guidance on DevSecOps, software supply chain security, CI/CD security, and application security testing Make decisions in the development and maintenance of security architectures and controls Understand compliance and risk management requirements for supported areas Ensure applications adhere to established Wells Fargo standards, policies, methodologies, and industry best practices Collaborate and consult with peers, colleagues, and managers to resolve issues and achieve goals Then "Required Qualifications:" list: 5+ years of Architecture experience, or equivalent demonstrated through one or a combination of the following: work experience, training, military experience, education 5+ years of Information Security, Security Architecture, Application Security, or Software Security experience Experience performing threat modeling, architecture reviews, and security assessments Knowledge of secure software development lifecycle (SSDLC) and secure coding practices Experience securing cloud-based applications, APIs, and modern application architectures Then "Desired Qualifications:" list: Strong knowledge of application security principles, OWASP Top 10, API Security, and common attack vectors Experience with SAST, DAST, SCA, IaC scanning, and software supply chain security controls Experience with cloud-native architectures, containers, Kubernetes, microservices, and APIs Knowledge of Azure, AWS, or Google Cloud security architectures Experience developing security standards, patterns, and reference architectures Familiarity with AI/GenAI security risks and mitigation strategies Strong verbal, written, and stakeholder management skills Then "Job Expectations:" includes many items: hybrid work schedule, not eligible for Visa sponsorship, proficiency in AI-assisted dev tools, leverage AI to accelerate..., apply strong technical judgment..., understand and account for model limitations..., apply AI responsibly..., ensure AI usage aligns with security, compliance, privacy, and ethical standards, serve as trusted advisor, partner with engineering..., deliver architecture reviews..., support and enhance enterprise Application Security standards..., mentor architects..., operate effectively in highly regulated..., influence security strategy..., etc. We need to decide sections: About the role (we have). Responsibilities (the bullet list after "In this role, you will:"). Requirements vs Qualifications: The posting has "Required Qualifications" and "Desired Qualifications". Could map Required Qualifications to "Requirements" section, Desired Qualifications to "Skills" maybe? Or we could have "Qualifications" section covering both required and desired? The instruction: Use headings for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we can have separate sections: Requirements (maybe required qualifications), Qualifications (maybe desired?), Skills (maybe desired qualifications?), but we need to avoid thin sections. Better to combine required and desired into Qualifications? But we have both headings available. Let's think: The posting includes "Required Qualifications" and "Desired Qualifications". We could map Required Qualifications to "Requirements" section, and Desired Qualifications to "Skills" section (since they are skills/knowledge). Or we could have "Qualifications" for required and "Skills" for desired. The instruction says "Prefer a few substantive sections over many thin ones." So maybe we combine required and desired into one "Qualifications" section, and maybe another "Skills" for soft skills? But we have strong verbal etc. That's a skill. Could be in Skills. Alternatively, we could have sections: About the role, Responsibilities, Requirements (required qualifications), Qualifications (desired qualifications), Skills (maybe soft skills), Benefits, Pay, Schedule. We have schedule info: "This position offers a hybrid work schedule". That's schedule. Pay: Salary ranges listed. Benefits: list of benefits. Thus we will have sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We must not include headings with filler text. Ensure each section has substantive content. Now we need to format:

About the role

Wells Fargo is seeking a Lead Systems Architect - Application Security to join the Security Architecture organization. This role will provide security architecture leadership across application development, APIs, DevSecOps, and emerging technologies, helping teams build secure-by-design solutions at enterprise scale.

Responsibilities

• Lead the implementation of complex projects and initiatives that have companywide scope
• Lead the implementation of complex projects and initiatives that have companywide scope
• Drive secure-by-design practices across applications, APIs, cloud-native platforms, and AI-enabled solutions
• Assist in the creation of architectural artifacts including standards, reference architectures, design patterns, and security requirements
• Participate in the definition of future technology architecture and Application Security strategy
• Identify medium to high architectural impact projects and provide security architecture guidance throughout the project lifecycle
• Conduct complex technology, security, and system assessments for architecture solutions
• Perform threat modeling, architecture reviews, and risk assessments for critical applications and platforms
• Provide guidance on DevSecOps, software supply chain security, CI/CD security, and application security testing
• Make decisions in the development and maintenance of security architectures and controls
• Understand compliance and risk management requirements for supported areas
• Ensure applications adhere to established Wells Fargo standards, policies, methodologies, and industry best practices
• Collaborate and consult with peers, colleagues, and managers to resolve issues and achieve goals

Requirements

• 5+ years of Architecture experience, or equivalent demonstrated through one or a combination of the following: work experience, training, military experience, education
• 5+ years of Information Security, Security Architecture, Application Security, or Software Security experience
• Experience performing threat modeling, architecture reviews, and security assessments
• Knowledge of secure software development lifecycle (SSDLC) and secure coding practices
• Experience securing cloud-based applications, APIs, and modern application architectures

Qualifications

• Strong knowledge of application security principles, OWASP Top 10, API Security, and common attack vectors
• Experience with SAST, DAST, SCA, IaC scanning, and software supply chain security controls
• Experience with cloud-native architectures, containers, Kubernetes, microservices, and APIs
• Knowledge of Azure, AWS, or Google Cloud security architectures
• Experience developing security standards, patterns, and reference architectures
• Familiarity with AI/GenAI security risks and mitigation strategies

Skills

• Strong verbal, written, and stakeholder management skills

Benefits

• Health benefits
• 401(k) Plan
• Paid time off
• Disability benefits
• Life insurance, critical illness insurance, and accident insurance
• Parental leave
• Critical caregiving leave
• Discounts and savings
• Commuter benefits
• Tuition reimbursement
• Scholarships for dependent children
• Adoption reimbursement

Pay

$119,000 - $187,000 - Charlotte, NC
$119,000 - $187,000 - Irving, TX
$119,000 - $187,000 - Columbus, OH
$131,000 - $206,000 - Minneapolis, MN
Pay Range Reflected is the base pay range offered for this position. Pay may vary depending on factors including but not limited to demonstrated examples of prior performance, skills, experience, or work location. Employees may also be eligible for incentive opportunities. $119,000.00 - $206,000.00

But we need to avoid duplication: The salary ranges repeated plus a line "Pay Range Reflected..." and then "$119,000.00 - $206,000.00". We should preserve all substantive info, not summarizing. So we include them as is. Could combine into

with line breaks.

Schedule

This position offers a hybrid work schedule

Also there is "This position is not eligible for Visa sponsorship" and many Job Expectations items about AI usage etc. Those are not covered by any heading; we could put them under Responsibilities? They are more like job expectations. Could be part of Responsibilities or a separate section like "Job Expectations". But we only have allowed headings list; we could put them under Responsibilities as additional items, or under Skills? Better to add them to Responsibilities as they are expectations/duties. The instruction: "Prefer a few substantive sections over many thin ones." So we can add those bullet points to Responsibilities. Thus we need to extract from Job Expectations: - This position is not eligible for Visa sponsorship - Demonstrate proficiency in using AI‑assisted development and analysis tools (e.g., GitHub Copilot and approved code‑centric agents) - Leverage AI to accelerate system design, coding, testing, analysis, and troubleshooting - Apply strong technical judgment when validating and integrating AI‑assisted outputs into solutions - Understand and account for model limitations, security risks, and operational considerations - Apply AI responsibly in development and production environments - Ensure AI usage aligns with security, compliance, privacy, and ethical standards - Serve as a trusted security architecture advisor for application and platform teams - Partner with engineering, architecture, risk, and cybersecurity teams to drive secure technology adoption - Deliver architecture reviews, threat models, and security recommendations for strategic initiatives - Support and enhance enterprise Application Security standards and secure-by-design practices - Mentor architects and engineers on application security and emerging technology risks - Operate effectively in a highly regulated and risk-driven environment - Influence security strategy, architecture patterns, and technology decisions across the enterprise We should add these