Principal Application Security Architect - 861

Key Responsibilities

• Hands-on Engineering & Assessment
• Perform manual reviews of code to find logic flaws and vulnerabilities that automated scanners often miss.
• Lead hands-on threat modeling sessions for complex systems to build security requirements before the first line of code is written.
• Conduct targeted technical testing of web services, APIs, and cloud workloads to verify that our defenses are working as intended.
• Governance & Tooling
• Architect and manage the enterprise scanning ecosystem including the technical tuning of SAST, DAST, and dependency scanning tools to ensure high-quality results.
• Build and maintain security gates directly within CI/CD pipelines to provide developers with fast and actionable feedback.
• Work side-by-side with engineering teams to review pull requests and ensure that security fixes are technically sound and effective.
• Risk Management & Compliance
• Create the "Golden Patterns" for authentication, encryption, and data handling so that engineering teams have a secure roadmap to follow.
• Ensure compliance with regulatory frameworks (e.g., CIS CSC18, NIST CSF, ISO27001, GDPR, SOC 2).
• Establish technical standards for how we identify and prioritize vulnerabilities based on real-world exploitability and business impact.
• Collaboration & Advisory
• Partner closely with product and engineering teams to design secure architectures for all new applications and major feature releases.
• Serve as the organization’s primary subject matter expert on application security tools, modern attack methodologies, and defensive coding.
• Translate complex technical vulnerabilities into clear business risks for both technical teams and non-technical executive stakeholders.
• Continuous Improvement
• Stay current with emerging threats, vulnerabilities, and security technologies.
• Drive automation in security testing and monitoring.
• Contribute to the evolution of enterprise application security strategy.

Requirements

• Bachelor's Degree Minimum
• Minimum 10+ years of experience in application security, penetration testing, or secure software development
• Minimum 5+ years of hands-on software engineering experience

Qualifications

• Due to Contractual requirements, must be a U.S. Person defined as, U.S. citizen permanent resident or green card holder, workers granted asylum or refugee status.
• Due to national security requirements imposed by the U.S. Government, candidates for this position must not be a People's Republic of China national or Russian national unless the candidate is also a U.S. citizen.
• Bachelor's degree in computer science, Cybersecurity, Information Systems, or related field preferred (or additional relevant work experience in lieu of degree)
• Strong technical knowledge of OWASP Top 10, SANS CWE, and secure coding practices.
• Fluency in at least two modern programming languages (e.g., Java, Python, JavaScript, Go).
• Hands-on experience building and tuning SAST and DAST processes at an enterprise level.
• Expert knowledge with cloud-native application security (AWS, Azure, GCP).
• Professional certifications such as CISSP, CSSLP, OSCP, or GWAPT preferred.
• Excellent analytical, problem-solving, collaboration, and communication skills.