Application Security Architect, Information Technology
About The Position
ServiceLink is seeking a builder-leader to own secure architecture direction for a large, cloud-native financial services platform on Azure that handles sensitive customer data. The role combines architecture judgment with hands-on implementation of key security controls and technical leadership to scale secure practices across engineering teams. Success is measured by reducing production risk through shipped controls, faster secure delivery, and measurable improvements in security coverage. The role’s expected time split is 50% hands-on engineering, including building reference implementations, improving pipelines, and validating controls in real services; 30% technical leadership, including architecture decisions, threat modeling, secure design reviews, and backlog direction; and 20% enablement and communication, including standards, coaching, leadership reporting, and audit-ready evidence. The position is responsible for advancing secure-by-default patterns across .NET, Python, and SPA services; identifying and remediating high-risk authentication, authorization, and PII exposure paths; operationalizing identity-first service-to-service architecture; integrating security testing and policy checks into CI/CD; and establishing measurable security posture metrics. It also includes defining AI/LLM security guardrails and validating security controls and resilience through chaos engineering. This is a hybrid role requiring work in ServiceLink’s Plano, Texas office at least three days per week. Candidates must live within reasonable commuting distance and be willing to work in the office regularly. Applicants must be authorized to work in the United States full-time without requiring employment visa sponsorship now or in the future.
Requirements
- 7+ years in application security, security engineering, or software engineering with significant security architecture ownership.
- Proven delivery in cloud-native Azure environments, including AKS, App Services, Entra ID, and Managed Identities.
- Deep experience with microservice and API security, authentication and authorization, secrets management, and data protection.
- Strong practical threat modeling and secure design review experience tied to shipped outcomes.
- Hands-on experience integrating security controls into CI/CD workflows; Azure DevOps is preferred.
- Ability to code and review implementation quality in at least one major backend stack; .NET or Python is preferred.
- Demonstrated ability to drive cross-team adoption, resolve trade-offs, and deliver under business constraints.
- Must be currently authorized to work in the United States on a full-time basis and not require employment visa sponsorship now or in the future.
- Must be located within reasonable commuting distance of the Plano, Texas office and willing to work there at least three days per week.
Nice To Haves
- Experience in financial services or a similarly regulated environment.
- Depth in Kubernetes network policy and runtime hardening.
- Experience building security metrics programs and engineering SLAs.
- Background partnering with offensive security and incident response teams.
Responsibilities
- Build and publish production-ready security reference architectures and reusable templates.
- Lead threat modeling and design reviews for new and materially changed services.
- Own RBAC and authorization architecture, including endpoint-to-data classification and least-privilege mapping.
- Design and drive managed identity adoption for SQL, Cosmos DB, and service-to-service communication.
- Implement container and Kubernetes hardening controls, including image trust, patch cadence, and egress guardrails.
- Evaluate and tune SAST, SCA, DAST, IaC, container, and secret scanning against real codebases and deployment patterns.
- Define AI/LLM security guardrails, including prompt-injection defenses, model and data access controls, and safe-use patterns for engineering teams.
- Lead chaos engineering exercises to validate security controls and resilience under failure and attack scenarios.
- Define risk-based security gates in Azure DevOps and partner with engineering on pragmatic exception handling.
- Convert third-party penetration test and internal findings into durable engineering fixes and regression checks.
- Mentor engineers and junior security staff through design pairing, code review, and incident retrospectives.
- Present architecture decisions, risks, and remediation progress to technical and executive stakeholders.
- Publish a target-state application security architecture with a prioritized implementation roadmap during the first 90 days.
- Deliver two reference implementations during the first 90 days: one API service and one data-access service demonstrating secure patterns end to end.
- Establish a baseline threat-model workflow for all tier-1 services and track remediation outcomes during the first 90 days.
- Define and launch security scorecard metrics for coverage, MTTR, policy exceptions, and high-risk exposure trends during the first 90 days.
- Complete a toolchain fit assessment with keep-or-replace recommendations and a rollout plan during the first 90 days.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
Education Level
No Education Listed
