Senior Application Security Architect
About The Position
The Senior Application Security Architect designs, reviews, and governs security architectures for enterprise applications, APIs, cloud-native platforms, and AI-enabled systems. The role partners with software engineering, data science, cloud engineering, cybersecurity, and business teams to embed security throughout software and AI development lifecycles. As part of the Security Architecture organization, the position helps protect the firm's applications, AI capabilities, data, and digital platforms by applying secure-by-design principles across traditional applications, cloud-native services, APIs, and AI-powered solutions. The successful candidate brings deep expertise in application security, secure software development, modern application architectures, and AI/ML security. The role calls for experience securing enterprise-scale applications across cloud, SaaS, hybrid, and on-premises environments, as well as familiarity with security testing, threat modeling, architecture reviews, and risk assessment. Limited travel may be required. The position follows State Street’s hybrid work model and standard business hours, with flexibility to support global stakeholders across multiple time zones.
Requirements
- Deep expertise in application security, secure software development, and modern application architectures.
- Strong understanding of AI/ML security risks, Large Language Models (LLMs), agentic AI systems, prompt injection, model misuse, and AI supply chain security.
- Experience securing cloud-native applications, APIs, microservices, containers, Kubernetes, and AI-enabled platforms.
- Strong analytical, problem-solving, and risk assessment skills to evaluate traditional and AI-specific security threats.
- Strong communication and stakeholder management skills, including collaboration across architecture, engineering, cybersecurity, cloud, and data science teams.
- Degree in Computer Science, Cybersecurity, Information Technology, Engineering, Data Science, or a related discipline.
- 14 or more years of experience in application security, software engineering, security architecture, AI security, or related technology disciplines, with at least 8 years of hands-on cybersecurity experience preferred.
- Demonstrated experience designing and securing enterprise-scale applications across cloud, SaaS, hybrid, and on-premises environments.
- Deep expertise in secure software development lifecycle (SSDLC), OWASP Top 10, API security, secure coding practices, and application security testing methodologies.
- Strong understanding of AI/ML architectures, LLMs, Retrieval-Augmented Generation (RAG), agentic systems, model security, prompt security, and responsible AI principles.
- Experience with cloud-native technologies, containers, Kubernetes, CI/CD pipelines, DevSecOps practices, and Infrastructure as Code (IaC).
- Experience conducting threat modeling, architecture reviews, penetration test remediation, and risk assessments for applications and AI-enabled solutions.
- Familiarity with SAST, DAST, IAST, software composition analysis (SCA), API security testing, model validation, and AI security assessment techniques.
- Ability to work effectively with application development, AI engineering, cloud engineering, architecture, and cybersecurity teams in a global environment.
Nice To Haves
- Professional certifications such as CISSP, CSSLP, CCSP, TOGAF, SABSA, AWS Security Specialty, Azure Security Engineer, AI Security, or equivalent certifications.
- Experience within financial services or other highly regulated industries.
Responsibilities
- Design and review secure architectures for enterprise applications, APIs, cloud-native platforms, AI-enabled systems, and emerging technologies.
- Define and maintain application security and AI security standards, architecture patterns, and security requirements.
- Conduct security architecture reviews, threat modeling exercises, and design assessments for applications, APIs, and AI solutions.
- Partner with application development, cloud engineering, AI engineering, and cybersecurity teams to embed security controls throughout the software and AI development lifecycles.
- Provide subject matter expertise in secure coding, application security testing, API security, authentication, authorization, AI security, and data protection.
- Assess security risks associated with applications, AI models, training data, prompts, agents, integrations, and third-party AI services.
- Drive adoption of secure-by-design, Zero Trust, DevSecOps, and AI security best practices across the enterprise.
- Evaluate emerging application security and AI security threats, technologies, and industry standards.
- Support enterprise application modernization, cloud transformation, DevSecOps, and AI adoption initiatives.
Benefits
- Retirement savings plan (401K) with company match.
- Insurance coverage including basic life, medical, dental, vision, long-term disability, and optional additional coverages.
- Paid time off including vacation, sick leave, short-term disability, and family care responsibilities.
- Access to an Employee Assistance Program.
- Incentive compensation, including eligibility for annual performance-based awards, subject to stated exclusions.
- Eligibility for certain tax-advantaged savings plans.
- Inclusive development opportunities.
- Flexible work-life support.
- Paid volunteer days.
- Employee networks.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
