Job Summary

The Application Security Architect defines and drives secure-by-design architecture, standards, and controls for applications and services. AI-augmented vulnerability remediation is a core discipline of the role: orchestrating and tuning application security tooling (SAST, DAST, SCA, container/IaC scanning, and ASPM) with LLM-based auto-fix and agentic triage, prioritizing by reachability and exploitability, and making sure every AI-generated fix is validated before it is merged.

The role leads threat modeling, secure architecture reviews, and risk-acceptance decisions; defines remediation playbooks, SLAs, and burn-down metrics; embeds automated security gates and fix suggestions into CI/CD and AI coding workflows; and partners with AppSec, engineering, and compliance teams. It is a hands-on, AI-native engineer-architect who sets reusable patterns for the wider organization.

Define and drive secure-by-design architecture, standards and controls for applications and services, with AI-augmented vulnerability remediation as a core discipline: orchestrate and tune SAST, DAST, SCA, container/IaC scanning and ASPM tooling (e.g. Snyk, Semgrep, Mend, Checkmarx, Corgea) with LLM-based auto-fix and agentic triage; apply reachability and exploitability analysis to prioritize true-positive, business-critical findings; validate AI-generated fixes for correctness, regression safety and no new risk before merge; lead threat modeling, secure architecture reviews and risk-acceptance/compensating-control decisions; define remediation playbooks, SLAs and vulnerability backlog burn-down metrics; embed automated security gates and fix-suggestions into CI/CD and AI coding workflows (Copilot, Claude Code, Cursor); partner with AppSec, engineering and compliance teams. Mandatory across all roles: practical AI-native engineering; strong modern application development; cloud-native, API, microservices and DevSecOps grounding; hands-on experience with at least one agent harness such as Claude Code, GitHub Copilot, Codex, Kiro or Cursor; enterprise security, governance, evaluation, observability and cost awareness.

Key Responsibilities

A. Secure-by-Design Architecture & Standards Define and drive secure-by-design architecture, standards, and control baselines for applications, APIs, microservices, and cloud-native services. Establish secure reference architectures and "paved road" patterns (authentication and authorization, secrets management, input validation, data protection, secure defaults, supply-chain controls). Align standards with recognized frameworks (e.g., OWASP ASVS and Top 10, NIST SSDF, SLSA, CIS benchmarks, ISO 27001) and with client and regulatory requirements. B. Security Tooling Orchestration Orchestrate and tune SAST, DAST, SCA, container scanning, IaC scanning, and ASPM tooling (e.g., Snyk, Semgrep, Mend, Checkmarx, Corgea) across the software delivery lifecycle. Select, integrate, and rationalize tools; manage rule sets, policies, baselines, and suppressions to reduce noise while preserving coverage. Consolidate findings into a unified view (ASPM) with deduplication, ownership mapping, and business-context enrichment. C. AI-Augmented Vulnerability Remediation Design LLM-based auto-fix and agentic triage workflows: finding intake, code and dependency context gathering, root-cause analysis, fix generation, pull request creation, and follow-up. Apply reachability and exploitability analysis (call-graph and data-flow reachability, exploit intelligence such as KEV and EPSS, runtime and exposure context) to prioritize true-positive, business-critical findings. Validate AI-generated fixes for correctness, regression safety, and no new risk before merge: re-scan, run unit, integration, and security tests, check for introduced vulnerabilities, license or dependency side effects, and behavioral changes; require human review for defined risk tiers. Define when auto-fix may merge automatically, when it requires approval, and when it must be handled manually. Measure the quality of AI remediation (fix acceptance rate, false-fix rate, regression rate, time-to-remediate) and tune prompts, context, and models accordingly. D. Threat Modeling, Architecture Review & Risk Decisions Lead threat modeling (e.g., STRIDE, attack trees, data-flow analysis) and secure architecture reviews for new and changing systems, including AI and agentic applications. Lead risk-acceptance and compensating-control decisions: document rationale, residual risk, expiry, and ownership; escalate appropriately. Review the security of AI-specific components such as LLM integrations, agents, tools, and MCP servers (prompt injection, excessive agency, data leakage, supply-chain risk). E. Playbooks, SLAs & Metrics Define remediation playbooks by vulnerability class and technology stack. Define vulnerability SLAs by severity, exploitability, and asset criticality; drive exception handling. Define and report vulnerability backlog burn-down metrics: mean time to remediate, aging, SLA adherence, fix rates by team, reachable-vs-total findings, and auto-fix share. F. CI/CD, AI Coding Workflows & DevSecOps Embed automated security gates and fix suggestions into CI/CD pipelines (pre-commit, pull request, build, deploy, runtime), with tiered blocking and warning policies. Integrate security guidance and fix suggestions into AI coding workflows (GitHub Copilot, Claude Code, Cursor and similar): secure prompts and rules files, security skills and MCP tools, policy checks on generated code, and guardrails against insecure patterns and risky dependencies. Apply supply-chain security practices: SBOM generation, provenance and signing, dependency policies, and secrets scanning. Define evaluation, observability, and cost controls for security automation and LLM usage (precision/recall of findings, fix-quality evaluation, tracing, token and scan cost). G. Collaboration, Governance & Enablement Partner with AppSec, engineering, platform, and compliance teams; translate security requirements into practical, developer-friendly controls. Provide audit and compliance evidence for security controls and remedi

Skill Requirements

• Bachelor's or Master's degree in Computer Science, Information Security, Engineering, or an equivalent field, or equivalent practical experience.
• 12+ years in software engineering, application security, or security architecture, with at least 5 years in AppSec or DevSecOps and at least 2 years applying LLMs or agents to security or engineering workflows.
• Track record of operating AppSec tooling at enterprise scale and reducing vulnerability backlogs measurably.

Technical Skills (Must Have)

1. Secure-by-design architecture: secure architecture patterns, authentication and authorization, cryptography and secrets, data protection, zero-trust principles, secure API and microservice design.
2. Application security tooling: hands-on with SAST, DAST, SCA, container scanning, IaC scanning, and ASPM, including tuning and policy management on tools such as Snyk, Semgrep, Mend, Checkmarx, and Corgea.
3. AI-augmented remediation: LLM-based auto-fix and agentic triage design, including context engineering, fix generation, and pull request automation.
4. Reachability and exploitability prioritization: call-graph and data-flow reachability, KEV/EPSS/CVSS interpretation, business-context risk scoring.
5. Fix validation: verifying correctness, regression safety, and no new risk, using tests, re-scanning, diff analysis, and tiered human review.
6. Threat modeling and architecture review: STRIDE and equivalent methods; risk assessment; compensating controls and risk acceptance.
7. Vulnerability management operations: playbooks, SLAs, backlog management, burn-down metrics, and executive reporting.
8. CI/CD and AI coding workflow integration: security gates, pre-commit and PR checks, rules files, skills, and MCP tools for Copilot, Claude Code, Cursor, and similar tools.
9. Supply-chain security: SBOM, provenance, signing, dependency governance, secrets scanning.
10. AI-native engineering: practical use of AI across the development lifecycle; hands-on with at least one agent harness (Claude Code, GitHub Copilot, Codex, Kiro, or Cursor).
11. Modern application development: strong proficiency in at least one language such as Java, Python, TypeScript, Go, or C#; able to read, write, and review production code and fixes.
12. Cloud-native, API & microservices: AWS/Azure/GCP, containers, Kubernetes, service design, API security.
13. DevSecOps: CI/CD pipelines, infrastructure as code, policy as code, secure SDLC.
14. Enterprise readiness: security, governance, evaluation, observability, and cost awareness, including cost modeling for scan and LLM usage.

Behavioral & Professional Skills

• Risk-based judgment; balances security rigor with delivery speed and developer experience.
• Influences engineering teams without authority; explains security trade-offs clearly to executives, developers, and auditors.
• Evidence-driven; comfortable questioning tool output and AI-generated fixes rather than trusting them by default.
• Mentoring, collaboration, and strong ownership across CoE, AppSec, engineering, and compliance teams.

Other Requirements

Role-specific

• Additional AppSec and remediation tools (e.g., GitHub Advanced Security and Copilot Autofix, GitLab, Veracode, Sonar, Black Duck, Aikido, Dependabot, Renovate, Trivy, Checkov, OWASP ZAP, Burp).
• Runtime and cloud security (CNAPP, CSPM, RASP, runtime reachability, WAF/API protection).
• Secure AI and LLM application security (OWASP Top 10 for LLM Applications, MITRE ATLAS, AI red-teaming).
• Policy as code (OPA/Rego, Kyverno, Conftest) and secure pipeline hardening.
• Static analysis internals: writing custom Semgrep or CodeQL rules, taint analysis, program analysis.
• Large-scale automated code change and migration tooling (e.g., OpenRewrite).
• Bug bounty, penetration testing, or red-team background.
• Compliance frameworks and evidence automation (SOC 2, PCI DSS, HIPAA, ISO 27001, DORA).
• Domain exposure in BFSI, healthcare, telecom, or public sector.

Common competencies (mandatory across all roles)

• Practical AI-native engineering and strong modern application development.
• Cloud-native, API, microservices, and DevSecOps grounding.
• Hands-on experience with at least one agent harness (Claude Code, GitHub Copilot, Codex, Kiro, Cursor).
• Enterprise security, governance, evaluation, observability, and cost awareness.

Certifications (preferred, not mandatory)

• Security: CSSLP, CISSP, GIAC (GWEB, GSSP), OSWE, or equivalent.
• Cloud security or architect certifications (AWS, Azure, or GCP).
• Vendor tool certifications (e.g., Snyk, Checkmarx) and TOGAF or SABSA for architecture.