Senior Application Security Architect

Job Title:
Senior Application Security Architect

Location:
Rockville, MD/ McLean, VA

The Senior Application Security Architect is responsible for designing, implementing, and governing enterprise‑wide application security architecture and standards
. This role focuses on defining security frameworks, performing architecture reviews, establishing security baselines, and leading strategic security initiatives with broad organizational impact.

This position requires a strong combination of technical expertise, architectural vision, and leadership
, with the ability to embed security throughout the software development lifecycle (SDLC). The ideal candidate is adaptable, able to manage multiple priorities simultaneously, and brings a proactive, collaborative, and positive approach to complex security challenges.

• Design and establish enterprise application security architecture frameworks and reference models aligned with business objectives and risk tolerance
• Lead architecture and design reviews to identify security gaps and recommend appropriate mitigations
• Develop and maintain security baselines, standards, patterns, and reference architectures across web, mobile, API, microservices, and modern deployment models
• Create, evolve, and facilitate threat modeling methodologies (e.g., STRIDE, PASTA, OCTAVE) with engineering teams
• Define secure coding standards and security requirements based on data classification and application risk profiles
• Architect solutions for authentication, authorization, encryption, and secure communication
• Establish security guardrails for cloud‑native, serverless, containerized, and infrastructure‑as‑code environments
• Design and implement API security strategies
  , including OAuth/OIDC, API gateways, rate limiting, and access controls
• Integrate security architecture principles into CI/CD pipelines to support Dev Sec Ops  initiatives
• Evaluate and recommend application security tools and technologies (SAST, DAST, IAST, SCA)
• Develop security architecture roadmaps and guide the implementation of future security capabilities
• Partner with development teams to design secure solutions that balance security, performance, and business needs
• Lead enterprise‑wide strategic security initiatives
• Leverage GenAI technologies to enhance architecture reviews and automate aspects of security analysis
• Maintain documentation for security decisions, patterns, standards, and reference implementations
• Develop and deliver security architecture training to developers and architects
• Stay current with emerging threats, technologies, and architectural trends
• Perform security design reviews for new applications and major system changes
• Architect secure data handling practices
  , including encryption at rest and in transit

• Bachelor’s degree in Computer Science, Information Security, or a related technical discipline
• 5+ years of experience in application security, including 2+ years in security architecture roles
• Strong knowledge of secure design principles, threat modeling, and security architecture patterns
• Experience designing security controls for cloud environments (AWS, Azure, GCP)
• Proficiency in evaluating and implementing application security tools (SAST, DAST, IAST, SCA)
• Hands‑on experience with tools such as Burp Suite, OWASP ZAP
  , or similar testing platforms
• Strong understanding of OWASP Top 10, SANS CWE
  , and common vulnerability patterns
• Experience implementing secure SDLC and Dev Sec Ops  practices
• Knowledge of authentication and authorization mechanisms (MFA, SSO, OAuth 2.0, SAML, OIDC)
• Experience with secure API design, microservices, containerization, and cloud‑native architectures
• Proficiency in at least one programming language (
  Java, Python, or JavaScript preferred
  )
• Experience with secure code review and vulnerability identification
• Knowledge of cryptographic protocols and secure implementations
• Experience securing modern application architectures (SPA, serverless, distributed systems)
• Excellent communication skills with the ability to explain complex security concepts to both technical and non‑technical audiences
• Proven experience leading cross‑functional security initiatives and…