Application Security Solution Architect

Bank of America • Addison, IL

4d • Onsite

About The Position

Bank of America is seeking an experienced Application Security Solution Architect for its Global Information Security (GIS) organization, within Cyber Security Technology (CST). CST is a globally distributed team responsible for cybersecurity innovation, architecture, engineering, solutions and capabilities development, cyber resiliency, access management engineering, data strategy, deployment maintenance, technical project management, and information technology security control support.

The role designs, strengthens, and secures solutions used by Bank applications throughout their lifecycle. It collaborates across Lines of Business and CIO teams to improve security adherence, identify inefficiencies, and prioritize improvements across the application development lifecycle and authentication-related projects. The architect applies knowledge of applicable laws, regulations, and information security concepts to establish and maintain security policies and standards, and works with information security engineering and product teams to identify risk gaps and guide application security design strategy.

The position also defines an architectural vision and solution aligned with enterprise architecture strategy, technology, and platform choices. It describes solution intent and operating environments, evaluates system impacts, identifies primary systems and interfaces, and supports end-to-end solution design. The role defines non-functional requirements and architectural runway for new epics and features, and works with stakeholders and service providers to ensure solutions are fit for purpose.

Requirements

• At least 2 years of relevant hands-on experience in application security in a large and complex organization.
• Knowledge of application-security laws, rules, regulations, and guidelines, including OWASP, NIST, ISO/IEC, CIS, SOX, OCC, PCI, GDPR, FISMA, and FFIEC, particularly in financial services.
• Knowledge of application security and penetration-testing methodologies, techniques, and technologies.
• Security knowledge covering core technology infrastructure, cloud technologies, and application security practices.
• Experience with application development tools, Static and Dynamic Application Security Testing, bills of materials, penetration testing, threat modeling, common development pipelines, and common cloud and on-premises designs and architectures.
• Ability to articulate facts and data-driven plans and partner with stakeholders to implement solutions that reduce risk and support relevant Secure by Design requirements.
• Strong attention to detail and advanced analytical skills.
• Excellent communication and presentation skills.
• Excellent organizational skills and ability to prioritize multiple tasks effectively.
• Hands-on experience and involvement in large and complex projects.
• Proficiency in data management, including strong data analytical capabilities and an advanced understanding of metadata collection and management.

Nice To Haves

• CISSP certification.
• Knowledge of SDLC-related tools and methodologies that support automated security compliance integration within different pipeline solutions.

Responsibilities

• Analyze, design, develop, and deliver secure application security solutions.
• Create and use security patterns that align application designs with business requirements.
• Lead solution design, including security requirements, risk identification, opportunities, and policy alignment.
• Collaborate with lines of business, security, engineering, and platform architecture teams.
• Serve as a technical security design subject-matter expert for products supporting the Software Development Lifecycle (SDLC).
• Own solution architecture and design documentation for application security platforms and components.
• Define application development architecture, standards, patterns, and security best practices.
• Maintain security blueprints, portfolio designs, and reference architectures.
• Communicate risks, challenges, and design considerations to engineering, operations, developers, information security, and senior leadership.
• Consult with business and operations stakeholders to identify technology challenges and opportunities, explore solutions through practical experiments and proofs of concept, and align solution intent and architectural vision with an evolving technology-change backlog.
• Work with product management and other stakeholders to plan and prioritize technology-focused backlog items for the architecture runway supporting business epics and features.
• Perform design and code reviews to ensure non-functional requirements, including security, performance, maintainability, scalability, usability, and reliability, are met.
• Lead rapid development of high-level architecture, refine it as business requirements emerge, and ensure the architecture is flexible and modular.
• Educate team members on technology practices, standardization strategies, and best practices.
• Clarify architecture and assist development teams with system design and options for resolving architectural impediments.
• Use defined best practices, templates, and documentation to create architectural designs and suggest improvements to them.

Benefits

• Affordable, competitive, and flexible benefits.
• Support for teammates’ physical, emotional, and financial wellness.
• Opportunities to learn, grow, and build a career.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed