Application Security Architect, Information Technology

ServiceLink is building and operating a large cloud-native financial services platform on Azure, and it needs an Application Security Architect to set secure architectural direction and turn it into repeatable, production-ready controls. This hybrid role in Plano, TX blends hands-on security engineering with technical leadership, guiding teams to embed application security into CI/CD and establish measurable security posture improvements.

Role focus

• Own secure architecture direction and implement key controls while leading others across new and changing services.
• Drive secure-by-default patterns, threat modeling, and practical adoption of security testing in delivery workflows.
• Operationalize identity-first service-to-service security using managed identities and least-privilege design.

Responsibilities

• Build and publish production-ready security reference architectures and reusable templates.
• Lead threat modeling and design reviews for new services and materially changed services.
• Own RBAC and authorization architecture, including endpoint-to-data classification and least-privilege mapping.
• Design and drive managed identity adoption for SQL, Cosmos DB, and service-to-service communication.
• Implement container and Kubernetes hardening controls, including image trust, patch cadence, and egress guardrails.
• Evaluate and tune SAST, SCA, DAST, IaC, container scanning, and secret scanning against real codebases and deployment patterns.
• Define AI/LLM security guardrails, including prompt-injection defenses, model/data access controls, and safe-use patterns for engineering teams.
• Lead chaos engineering exercises to validate security controls and resilience under failure and attack scenarios.
• Define risk-based security gates in Azure DevOps and partner with engineering on pragmatic exception handling.
• Convert third-party pen test and internal findings into durable engineering fixes and regression checks.
• Mentor engineers and junior security staff through design pairing, code review, and incident retrospectives.
• Present architecture decisions, risks, and remediation progress to technical and executive stakeholders.
• Publish a target-state application security architecture with a prioritized implementation roadmap.
• Deliver two reference implementations (one API service and one data-access service) showing secure patterns end-to-end.
• Stand up a baseline threat-model workflow for all tier-1 services with tracked remediation outcomes.
• Define and launch security scorecard metrics including coverage, MTTR, policy exceptions, and high-risk exposure trends.
• Complete a toolchain fit assessment with keep/replace recommendations and a rollout plan.

Operating model

• 50% hands-on engineering: build reference implementations, improve pipelines, validate controls in real services.
• 30% technical leadership: architecture decisions, threat modeling, secure design reviews, backlog direction.
• 20% enablement and communication: standards, coaching, leadership reporting, audit-ready evidence.

Expected outcomes you own

• Secure-by-default patterns adopted across .NET, Python, and SPA services.
• Identification and remediation of high-risk authN/authZ and PII exposure paths.
• Identity-first service-to-service architecture operationalized (managed identities, token patterns, least privilege).
• Security testing and policy checks integrated into CI/CD with clear ownership and SLAs.
• Security posture measured with trendable metrics rather than one-time reporting.

First 90 days

• Publish a target-state application security architecture with a prioritized implementation roadmap.
• Deliver two reference implementations (one API service and one data-access service) showing secure patterns end-to-end.
• Stand up a baseline threat-model workflow for all tier-1 services with tracked remediation outcomes.
• Define and launch security scorecard metrics (coverage, MTTR, policy exceptions, high-risk exposure trends).
• Complete a toolchain fit assessment with keep/replace recommendations and rollout plan.

Requirements

• 7+ years in application security, security engineering, or software engineering with significant security architecture ownership.
• Proven delivery in cloud-native Azure environments (AKS, App Services, Entra ID, Managed Identities).
• Deep experience with microservice/API security, authentication/authorization, secrets management, and data protection.
• Strong practical threat modeling and secure design review experience tied to shipped outcomes.
• Hands-on experience integrating security controls into CI/CD workflows (Azure DevOps preferred).
• Ability to code and review implementation quality in at least one major backend stack (.NET or Python preferred).
• Demonstrated ability to drive cross-team adoption, resolve trade-offs, and deliver under business constraints.
• Financial services or similarly regulated environment experience.
• Kubernetes network policy and runtime hardening depth.
• Experience building security metrics programs and engineering SLAs.
• Background partnering with offensive security and incident response teams.

Technologies

• Azure, AKS, App Services, Entra ID, Managed Identities, .NET, Python
• SQL, Cosmos DB, Kubernetes, Azure DevOps
• SAST, SCA, DAST, IaC, container scanning, secret scanning, CI/CD
• RBAC, SPAs, AI/LLM, Generative AI, continuous delivery, cloud-native

Location: Plano, TX (hybrid)
Salary: USD 170,000 - 190,000 per yearly
Experience: 7+ years