[Hiring] Application Security Architect @EPAM Systems

Role Description

We are seeking an experienced Application Security Architect with a passion for AI-driven security innovation to join our team. In this role, you will design and implement robust security architectures for enterprise applications while leveraging AI-assisted tools to enhance application security practices. You will collaborate across engineering, DevOps, cloud and compliance teams to embed security into every stage of the software development lifecycle.

• Design and implement security architectures and controls for enterprise applications, APIs, microservices and cloud-native applications
• Gather business, technical and compliance requirements to design secure application solutions for new implementations, migrations and security improvements
• Define and improve application security capabilities, including authentication, authorization, API security, encryption, secrets management and secure configuration
• Conduct security architecture reviews, threat modeling, secure design assessments and application security risk analysis
• Develop application security reference architectures, security standards, secure design patterns and secure development guidelines
• Support Secure Software Development Lifecycle (SSDLC), secure-by-design principles and DevSecOps integration across engineering teams
• Evaluate and improve application security technologies and processes, including SAST, DAST, SCA, secrets scanning and vulnerability management
• Review application security vulnerabilities, identify architectural weaknesses and recommend appropriate remediation strategies
• Collaborate with development, DevOps, cloud, infrastructure, IAM, security operations and compliance teams to integrate security into application design and development
• Leverage AI-assisted tools and workflows to improve application security activities such as threat modeling, vulnerability assessment, secure code review, compliance analysis, security scripting and workflow automation
• Identify opportunities for AI-assisted application security automation while ensuring appropriate validation, data protection and human oversight
• Communicate application security risks, architectural decisions and remediation plans to stakeholders and security leadership

Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, Engineering, or equivalent practical experience
• 5+ years of information security experience, with a focus on application security architecture, secure application design or application security engineering
• Background in delivering or significantly contributing to application security architecture, secure development, DevSecOps integration or application security improvement projects
• Expertise in application security, including identifying vulnerabilities, assessing security risks and recommending technical security controls
• Understanding of application security principles, OWASP Top 10, secure coding practices, API security, authentication, authorization and common vulnerability mitigation techniques
• Proficiency in application security architecture reviews, threat modeling, secure design assessments or security risk analysis
• Familiarity with application security tools and technologies such as SAST, DAST, SCA or secrets scanning solutions
• Knowledge of Secure SDLC, DevSecOps, CI/CD security and secure-by-design principles
• Working knowledge of at least one programming language such as Python, Java or C# (or JavaScript/TypeScript, Go), sufficient to review code and assess application security risks
• Competency in related security domains, including cloud security, IAM, network security, data protection and security operations
• Understanding of security architecture frameworks such as Zero Trust, NIST, ISO 27001 or OWASP guidelines
• Skills in application security automation, scripting and security tooling integration
• Intermediate practical experience with AI-assisted tools and automation, including using AI for vulnerability analysis and threat modeling, applying structured prompting, generating and validating scripts or secure code recommendations, simplifying repetitive workflows and configuring AI-assisted integrations
• Understanding of safe AI usage, including data protection, access control and validation of AI-generated outputs, with willingness to further develop AI automation skills
• Strong communication, collaboration and hands-on technical skills

Requirements

• Experience with application security platforms such as Snyk, Checkmarx or Veracode (or SonarQube, Semgrep, GitHub Advanced Security, Burp Suite, OWASP ZAP)
• Background in application security architecture for cloud-native applications, microservices, containers and Kubernetes environments
• Familiarity with threat modeling methodologies and tools such as STRIDE, OWASP Threat Dragon or Microsoft Threat Modeling Tool
• Skills in DevSecOps, CI/CD security automation, Infrastructure as Code scanning and policy-as-code solutions
• Knowledge of software supply chain security, SBOM, dependency management and third-party component security
• Expertise in API security, OAuth 2.0, OpenID Connect, secrets management and secure application authentication patterns
• Capability to integrate application security findings with SIEM/SOAR, ticketing or vulnerability management platforms
• Proficiency in AI automation tools such as AI agents, Microsoft Copilot Studio, Azure OpenAI (or Amazon Bedrock, LangChain, Power Automate)
• Understanding of AI application security risks, including prompt injection, data leakage, insecure output handling and excessive AI agent permissions
• Familiarity with OWASP Top 10 for LLM Applications or similar AI security guidelines
• Security certifications such as CSSLP, CISSP, CISM (or CCSP, GWAPT, GWEB, OSCP, OSWE)
• AI-related certifications such as AI-900 or AWS Certified AI Practitioner