Application Security Architect – Cloud & DevSecOps

The Application Security Architect for Clifton Larson Allen will operate at the intersection of application security architecture, engineering, Dev Ops, and cloud security. In this onsite role in Milwaukee, WI
, you will help shape how secure design reviews are run and translate that governance into practical automation across development workflows. The position also drives a Cloud Security Posture Management practice that connects people, processes, and technology to ongoing engineering delivery.

• Lead and participate in secure design reviews for proprietary, commercial, cloud, and hybrid solutions.
• Document identified risks, required mitigations,
  risk owners
  , exceptions, and decisions related to residual risk
  .
• Review system interaction diagrams and detailed logical, functional, physical, and data-flow diagrams
  .
• Identify trust boundaries
  , security boundaries, integration points, administrative interfaces, data stores, and external dependencies.
• Develop reusable security standards, assessment patterns, review templates, control baselines, and architectural guidance.
• Establish and build a Cloud Security Posture Management practice by coordinating people, processes, technology, governance, and service expectations.
• Assess cloud permissions, secrets management, deployment architecture, infrastructure as code, container images, orchestration configurations, and cloud-native deployment patterns.
• Find opportunities to prevent configuration issues and policy violations before deployment using policy-as-code
  , automated validation, and reusable engineering guardrails.
• Provide technical security leadership across Development, Cloud, Platform, Product, Data, Information Technology, Enterprise Architecture, and Risk teams.
• Connect code, pipeline, identity, integration, data, and cloud architecture risks to practical security controls and business outcomes.
• Separate mandatory security requirements from recommendations and risk-based enhancements.
• Escalate unresolved material risks through established risk-acceptance processes.
• Communicate technical risks, required controls, exceptions, ownership, and residual risk to technical and non-technical stakeholders, building partnerships and influencing cross-functional teams without direct authority.

• Experience leading or supporting secure design reviews for application, cloud, commercial, and hybrid solutions.
• Experience reviewing technical architecture, system interaction, and data-flow diagrams.
• Experience with application security architecture, cloud security, Dev Ops security, and security engineering.
• Knowledge of CI/CD pipelines,
  Git Hub Actions and workflows
  , infrastructure as code, containers, and software supply-chain security.
• Experience assessing cloud permissions, secrets management, deployment architecture, container images, orchestration configurations, and cloud-native deployment patterns.
• Experience connecting technical security risks to practical controls and business outcomes.
• Ability to communicate technical risks and security requirements to both technical and non-technical stakeholders.
• Ability to build relationships and influence cross-functional teams without direct authority.

• Git Hub Actions; CI/CD pipelines; workflows
• Infrastructure as code; containers
• Software supply-chain security;
  Cloud Security Posture Management
• Azure cloud services; enterprise cloud identity platforms
• Black Duck Polaris; software composition analysis
• Application security platform
• Policy-as-code; artifact integrity; secrets management
• Automated compliance controls
• NIST security and risk-management frameworks
• API security; integration platforms
• Secure container orchestration patterns
• Git Hub Actions and workflows

• Comprehensive benefit…