Senior Application Security Architect, Enterprise Technology

Define and maintain practical secure software development lifecycle (SDLC), application security architecture, and production-readiness standards. Establish risk-based review criteria to perform security reviews of internet-facing, sensitive-data, AI-enabled, and other high-risk applications. Conduct threat modelling and architecture assessments covering applications, APIs, data flows, identity, cloud services, third-party dependencies, and deployment topology. Perform targeted source-code reviews of security-critical areas, including authentication, authorization, input handling, data access, secrets, session management, and integrations. Assess controls related to identity, API security, encryption, secrets management, network exposure, segmentation, logging, monitoring, and data protection. Document and prioritize material risks and remediation; validate that required controls are addressed, maintain review evidence, and route material exceptions through formal risk acceptance. Develop reusable secure reference architectures, design patterns, checklists, and guidance that help teams deliver secure and supportable solutions. Define and support appropriate automated security controls within CI/CD pipelines, including code, dependency, secret, container, and infrastructure-as-code scanning. Assess open-source and third-party components for provenance, known vulnerabilities, patching practices, and supportability, and identify licensing concerns for review with Legal or Procurement. Apply established application, cloud, identity, data, and software supply-chain security principles to AI/LLM applications, self-hosted models, AI coding tools, and other emerging technologies. Partner with cybersecurity, cloud services, infrastructure, analytics, development teams, and business stakeholders to provide practical guidance and support remediation while maintaining clear ownership within accountable teams. Support selected proofs of concept, validation testing, and post-deployment verification where hands-on technical involvement adds value.