Senior Application Security Architect

MasterApp Labs•Richmond, VA

6h•$65 - $70•Hybrid

About The Position

The Senior Application Security Architect defines security architecture principles, standards, patterns, reference implementations, and guardrails for web, mobile, API, microservice, and cloud-native systems. The role reviews application architectures and designs, identifies trust boundaries, attack paths, data flows, security gaps, and compensating controls, and leads or facilitates threat modeling for new applications, major features, integrations, and high-risk changes. The architect establishes repeatable requirements for authentication, authorization, session management, encryption, secrets management, logging, privacy, API protection, and data protection. The role partners with engineering, cloud, platform, and incident-response teams to embed security into the SDLC and application hosting environments, guide security tooling, manage application and dependency vulnerabilities, assess third-party components, and improve security following incidents. The position also designs end-to-end data security architectures across Azure, SQL Server, Dynamics 365, Power Platform, and ArcGIS, using automated classification, encryption, DLP rules, and privacy risk assessments. It establishes granular data-access controls and centralized database audit logging and monitoring aligned with VITA SEC 530. The architect maintains architecture documentation, security decision patterns, risk registers, and exception documentation. The position is a contract role in Richmond, Virginia. It is hybrid, with onsite work four days per week during an initial 90-day probationary period; reduced onsite commitment may be possible after successful probation. Flexible work-from-home options are available.

Requirements

Bachelor’s degree in computer science, cybersecurity, engineering, or a related field, or equivalent practical experience.
10+ years in software engineering, application security, security engineering, or related technical roles, including 2+ years designing security architecture for systems.
Strong understanding of secure software-development principles and common application risks, including the OWASP Top 10, insecure authorization, injection, deserialization, and API abuse.
Experience designing and implementing end-to-end security architectures for data at rest, in transit, and in use across Azure, SQL Server, Dynamics 365, Power Platform, and ArcGIS platforms.
Experience with automated classification such as Microsoft Purview, robust encryption, DLP rules, and privacy risk assessments (DPIAs) to protect sensitive state transportation and infrastructure assets.
Experience enforcing granular data-access controls, including RBAC, Row-Level Security, Column-Level Encryption, and dynamic masking, and establishing centralized database audit logging and activity monitoring aligned with VITA SEC 530.
Demonstrated experience with threat modeling and security architecture reviews.
Experience securing APIs, web applications, distributed systems, cloud platforms, CI/CD pipelines, and containerized workloads.
Working knowledge of secure coding in one or more common ecosystems, such as Java, .NET, JavaScript/TypeScript, or Python.
Experience with identity, OAuth 2.0, OpenID Connect, SAML, JWTs, authorization design, PKI/TLS, encryption, and secrets-management practices.
Ability to explain technical risks and tradeoffs clearly to engineers, product managers, executives, and nontechnical stakeholders.
Strong written communication skills, including the ability to create architecture diagrams, standards, risk assessments, and actionable remediation plans.
The skills table lists 6 years of experience designing and implementing security architecture for IT systems.
The skills table lists 6 years of experience with secure software-development principles and common application risks.
The skills table lists 6 years of experience designing and implementing security architectures for the Microsoft stack, including Azure, O365, Power Platform, and D365.
The skills table lists 6 years of experience with threat modeling and security architecture reviews.
The skills table lists 6 years of experience securing APIs, web applications, distributed systems, cloud platforms, CI/CD pipelines, and containerized workloads.
The skills table lists 6 years of experience with identity, authentication and authorization standards, PKI/TLS, encryption, and secrets management.
The skills table lists 10 years of strong written communication experience creating architecture diagrams, standards, risk assessments, and remediation plans.

Nice To Haves

Experience in a regulated environment such as financial services, healthcare, government, or payments; the skills table indicates 6 years highly desired.
Experience implementing DevSecOps programs and security automation at scale; the skills table indicates 4 years highly desired.
Familiarity with privacy engineering, data classification, and relevant compliance frameworks; the skills table indicates 4 years highly desired.
Certifications such as CISSP, CSSLP, CCSP, GIAC, cloud-security certifications, or relevant vendor credentials.
Experience conducting or coordinating penetration testing and translating results into durable architectural improvements; the skills table indicates 6 years highly desired.
Experience with security architectures in Esri's ArcGIS platform; the skills table indicates 2 years highly desired.

Responsibilities

Define application-security architecture principles, standards, patterns, reference implementations, and guardrails for web, mobile, API, microservice, and cloud-native systems.
Perform architecture and design reviews and identify trust boundaries, attack paths, data flows, security gaps, and compensating controls.
Lead or facilitate threat modeling for new applications, major features, integrations, and high-risk changes.
Establish repeatable security requirements for authentication, authorization, session management, encryption, secrets management, logging, privacy, API protection, and data protection.
Partner with software engineers to integrate security throughout the SDLC, including code review, CI/CD pipelines, infrastructure as code, testing, release approval, and production monitoring.
Evaluate and guide security tools, including SAST, DAST, software composition analysis, container and image scanning, API security testing, secret scanning, and runtime protection.
Define application and dependency vulnerability-management approaches, including severity criteria, remediation SLAs, exception processes, and fix verification.
Assess the security risk of third-party libraries, open-source dependencies, SaaS integrations, and vendor-provided components.
Design identity and access-control patterns, including least privilege, MFA/SSO integration, service-to-service authentication, RBAC/ABAC, and privileged-access controls.
Work with cloud and platform teams to secure application hosting environments, including Kubernetes, serverless, containers, CI/CD, cloud IAM, network segmentation, and secrets storage.
Advise incident-response teams on application-layer threats and contribute to root-cause analysis and post-incident security improvements.
Maintain architecture documentation, security decision patterns, risk registers, and exception documentation.
Design and implement end-to-end security architectures for data at rest, in transit, and in use across Azure, SQL Server, Dynamics 365, Power Platform, and ArcGIS, using automated classification, encryption, DLP rules, and privacy risk assessments.
Enforce granular data-access controls, including RBAC, Row-Level Security, Column-Level Encryption, and dynamic masking.
Establish centralized database audit logging and activity-monitoring pipelines aligned with VITA SEC 530 security standards.