Application Security Architect + AI (basic)

EPAM Systems; Polska; On-site; PLN 180,000 - 260,000; Full time

Job summary

EPAM Systems Inc in Poland seeks an Application Security Architect with AI focus to shape secure design across enterprise applications, APIs and cloud-native environments. You will drive threat modeling, security architecture reviews and risk assessments while collaborating with development, cloud, IAM and security operations teams.

The role emphasizes SDLC security, AI-assisted tooling for vulnerability analysis, secure code reviews and remediation guidance, ensuring data protection and

Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, or related field.
• 5+ years of information security focused on application security architecture, secure design or engineering.
• Hands-on experience with SAST, DAST, SCA, secrets scanning or similar security testing tools.
• Understanding of Secure SDLC, DevSecOps, CI/CD security and secure-by-design principles.
• Familiarity with AI-assisted tools and automation for application security tasks.

Responsibilities

• Design and implement security architectures for enterprise applications, APIs, microservices and cloud-native apps.
• Conduct threat modeling, risk analysis, and secure design assessments.
• Support SSDLC and DevSecOps integration across engineering teams.
• Evaluate and improve application security technologies and processes (SAST, DAST, SCA, secrets scanning).
• Collaborate with cross-functional teams to integrate security into development workflows.

Skills

Application security

Threat modeling

Secure development

DevSecOps

SAST/DAST/SCA

CI/CD security

Programming knowledge

AI-assisted tools

Education

Bachelor's degree in CS/Cybersecurity

Tools

Snyk

Checkmarx

Veracode

SonarQube

Semgrep

Burp Suite

OWASP ZAP

Job description

Every application faces a challenge: how to earn trust when data and decisions depend on it. The role of "Application Security Architect + AI (foundational level)" serves as a nexus between secure design and the pursuit of reliable, properly governed data. Trusted platforms are built on foundations that absorb change without extra complexity. In this role, you decide how security architecture shapes the way applications support growth and resilience. The person in this position makes it possible for teams to build with confidence, knowing their systems are protected.

Responsibilities

Design and implement security architectures and controls for enterprise applications, APIs, microservices and cloud-native applications, gathering business, technical and compliance requirements to design secure application solutions for new implementations, migrations and security improvements Define and improve application security capabilities, including authentication, authorization, API security, encryption, secrets management and secure configuration, conducting security architecture reviews, threat modeling, secure design assessments and application security risk analysis Develop application security reference architectures, security standards, secure design patterns and secure development guidelines Support Secure Software Development Lifecycle (SSDLC), secure-by-design principles and DevSecOps integration across engineering teams Evaluate and improve application security technologies and processes, including SAST, DAST, SCA, secrets scanning and vulnerability management, reviewing application security vulnerabilities, identifying architectural weaknesses and recommending appropriate remediation strategies Collaborate with development, DevOps, cloud, infrastructure, IAM, security operations and compliance teams to integrate security into application design and development Support security automation and application security tooling integration within CI/CD pipelines and development workflows Use AI-assisted tools and workflows to improve application security activities, including threat modeling and security architecture analysis, vulnerability assessment and remediation recommendations, secure code review and security testing support, application security requirements and compliance analysis, security scripting, reporting and documentation, and repetitive task and workflow automation Identify opportunities for AI-assisted application security automation while ensuring appropriate validation, data protection and human oversight, communicating application security risks, architectural decisions and remediation plans to stakeholders and security leadership Communicate application security risks, architectural decisions and remediation plans to stakeholders and security leadership

Requirements

Bachelor's degree in Computer Science, Cybersecurity, Engineering or equivalent practical experience Five-plus years of information security experience with a focus on application security architecture, secure application design or application security engineering, delivering or significantly contributing to application security architecture, secure development, DevSecOps integration or application security improvement projects Strong hands-on expertise in application security, including identifying vulnerabilities, assessing security risks and recommending technical security controls, understanding of application security principles, OWASP Top 10, secure coding practices, API security, authentication, authorization and common vulnerability mitigation techniques Practical experience with application security architecture reviews, threat modeling, secure design assessments or security risk analysis, experience with application security tools and technologies such as SAST, DAST, SCA, secrets scanning or similar security testing solutions Good understanding of Secure SDLC, DevSecOps, CI/CD security and secure-by-design principles, working knowledge of at least one programming language such as Python, Java, C#, JavaScript/TypeScript or Go, sufficient to review code and assess application security risks Working knowledge of related security domains, including cloud security, IAM, network security, data protection and security operations, without requiring deep specialization in each, understanding of security architecture principles and frameworks such as Zero Trust, NIST, ISO 27001 or OWASP guidelines Familiarity with application security automation, scripting and security tooling integration, intermediate practical experience with AI-assisted tools and automation, including some of the following: using AI tools for vulnerability analysis, threat modeling and security research, applying structured prompting for technical and security tasks, generating and validating scripts, queries, secure code recommendations and security documentation with AI, using AI to simplify repetitive application security workflows, basic experience configuring AI-assisted workflows or integrations Understanding of safe AI usage, including data protection, access control and validation of AI-generated outputs, willingness to further develop AI automation skills Strong communication and collaboration skills Hands-on technical proficiency

Nice to have

Experience with application security platforms such as Snyk, Checkmarx, Veracode, SonarQube, Semgrep, GitHub Advanced Security, Burp Suite or OWASP ZAP, and application security architecture for cloud-native applications, microservices, containers and Kubernetes environments Experience with threat modeling methodologies and tools such as STRIDE, OWASP Threat Dragon or Microsoft Threat Modeling Tool, and DevSecOps, CI/CD security automation, Infrastructure as Code scanning and policy-as-code solutions Experience with software supply chain security, SBOM, dependency management and third-party component security, and API security, OAuth 2.0, OpenID Connect, secrets management and secure application authentication patterns Experience integrating application security findings with SIEM/SOAR, ticketing or vulnerability management platforms, and AI automation, AI agents, Microsoft Copilot Studio, Azure OpenAI, Amazon Bedrock, LangChain, Power Automate or similar tools Understanding of AI application security risks, including prompt injection, data leakage, insecure output handling and excessive AI agent permissions, familiarity with OWASP Top 10 for LLM Applications or similar AI security guidelines Security certifications such as CSSLP, CISSP, CISM, CCSP, GWAPT, GWEB, OSCP, OSWE or similar, and AI-related certifications such as AI-900 or AWS Certified AI Practitioner are a plus