Application Security Architect

IQVIA; Porto; Hybrid; EUR 70,000 - 100,000; Full time

Job summary

IQVIA is seeking an experienced Application Security Architect to protect PHI and sensitive client data across healthcare applications, APIs, data exchanges, and cloud services. You will work with global teams to design safeguards, influence Secure SDLC and AIDLC, and drive risk-based reviews throughout development and deployment in AWS environments.

You will lead threat modeling, define validation and testing requirements, and provide architectural guidance for vulnerability management, CI/CD

Qualifications

• 6+ years of progressive experience in application security or related field.
• Experience threat modeling, data flow mapping, and translating threats into requirements.
• Knowledge of Secure SDLC, AIDLC, CI/CD security, SAST/SCA/DAST, and AI security considerations.
• Experience with AWS architecture, OWASP frameworks, HIPAA/HITRUST/SOC 2/CIS/NIST standards.

Responsibilities

• Establish risk-based review criteria for new applications, AI features, and infrastructure; document decisions and evidence.
• Lead threat modeling for applications, APIs, data flows, and AI-enabled features; translate threats into design requirements.
• Provide architectural guidance for testing, vulnerability management, and risk-based release criteria.
• Align Cedar Gate patterns with IQVIA security architecture requirements.

Skills

Threat modeling

Secure SDLC

AIDLC

CI/CD security

SAST

SCA

DAST

API security

AWS

OWASP ASVS

HIPAA

PHI processing

Multi-tenant SaaS

cryptography

Education

Bachelor’s degree in a related field

Tools

AWS

Job description

Application Security Architect### Application Security ArchitectApply: Porto Salvo, Portugal: Full time: Posted Today: R1572580**Application Security Architect****Location:** Portugal **Role and Responsibilities**Protecting Personal Health Information (PHI) and other sensitive client data is a core responsibility of this position. The Application Security Architect will work with Cedar Gate application teams, who are based both in Nepal and the United States, to design and improve safeguards across healthcare applications, APIs, data exchanges, cloud services, and supporting infrastructure.This senior, hands-on role is an embedded design and risk advisor for Cedar Gate product, development, engineering, DevOps, and infrastructure teams where all services are hosted in AWS or Snowflake. Based in Portugal and reporting to the Cedar Gate Associate Director, Security, the architect will support new applications, functionality, material changes, and technology modernization.The role will influence Cedar Gate’s Secure SDLC and AIDLC, while engineering retains solution ownership and application security analysts perform routine testing, tooling, triage, and remediation tracking. **Principal responsibilities include:**• Establish risk-based review criteria for new applications, functionality, material changes, AI features, and supporting infrastructure; perform complex reviews and document requirements, decisions, exceptions, and closure evidence. Identify systemic weaknesses and modernization priorities.• Lead threat modeling for applications, APIs, administrative functions, sensitive data flows, trust boundaries, and AI-enabled features using STRIDE, misuse cases, and attack-path analysis; translate threats into design requirements.• Maintain reusable application security patterns, architecture decision records, and guidance for identity, tenant isolation, input and file handling, cryptography, secrets, logging, PHI workflows, APIs, OAuth 2.0, OpenID Connect, and service communications.• Influence the Secure SDLC and AIDLC through architecture gates, threat-modeling criteria, secure coding and AI guardrails, testing requirements, and risk-based release criteria. Address prompt injection, data leakage, insecure tool or output use, excessive agency, authorization bypass, and improper use of PHI, source code, or credentials.• Define validation requirements for AI-generated code and AI-enabled applications, including developer review, provenance and licensing, secrets and dependency scanning, SAST, SCA, DAST, API, container, infrastructure-as-code, and pre-production testing; analysts execute routine reviews.• Provide architectural guidance and escalation for testing, vulnerability management, supply-chain risk, penetration testing, and high-risk findings. Present design recommendations, tradeoffs, and remediation strategies to engineering, product, security leadership, and governance forums.• Provide senior architectural review to Nepal application and cloud security personnel for complex reviews, threat models, AI assessments, risk decisions, and systemic findings without duplicating analyst work. Align Cedar Gate patterns with IQVIA security architecture requirements. **Required Experience and Qualifications**• 6 or more years of progressive experience in application security, software engineering, product security, cloud security, security engineering, or application security architecture; 6–8 years of directly relevant experience is preferred.• Experience reviewing new and existing application architectures, conducting threat modeling, documenting sensitive data flows and trust boundaries, and translating threats into practical requirements; strong knowledge of application and API security, multi-tenant SaaS, identity, cryptography, secrets, logging, supply-chain risk, and PHI processing.• Experience influencing Secure SDLC and AIDLC practices, defining risk-based review and release criteria, and embedding security into CI/CD. Knowledge of SAST, SCA, DAST, API, secrets, container, infrastructure-as-code, and penetration testing; experience evaluating generated code, AI assistants, agents, LLM integrations, and sensitive-data handling is required.• Working knowledge of application-facing AWS architecture and relevant standards, including OWASP ASVS, OWASP Top 10, OWASP API Security Top 10, OWASP SAMM, OWASP LLM guidance, NIST Secure Software Development Framework, MITRE CWE, HIPAA, HITRUST, SOC 2, CIS, and NIST requirements.• Strong analytical and communication skills; ability to work predominantly during U.S. business hours with teams in the United States, Nepal, Portugal, and other IQVIA locations; fluent English; bachelor’s degree in a related field or equivalent practical experience. **Preferred Experience**• Healthcare SaaS, PHI exchange, analytics, managed file transfer or sFTP, and multi-tenant platforms.• Hands-on development or DevOps experience; integration of an acquired business into enterprise AppSec practices• CSSLP, CISSP, CCSP, GIAC Web Application Defender, or relevant AWS certification.IQVIA is a leading global provider of clinical research services, commercial insights, and healthcare intelligence to the life sciences and healthcare industries. We create intelligent connections to accelerate the development and commercialization of innovative medical treatments to help improve patient outcomes and population health worldwide. Learn more at https://jobs.iqvia.com.IQVIA is committed to integrity in our hiring process and maintains a zero tolerance policy for candidate fraud. All information and credentials submitted in your application must be truthful and complete. Any false statements, misrepresentations, or material omissions during the recruitment process will result in immediate disqualification of your application, or termination of employment if discovered later, in accordance with applicable law. We appreciate your honesty and professionalism.At IQVIA, we believe that diversity, inclusion, and belonging empower our mission to accelerate innovation for a healthier world. We create a culture of belonging by valuing the perspectives of all talented employees worldwide and providing them with the opportunity to power smarter healthcare for everyone, everywhere. When our talented employees bring their authentic selves and their diverse experiences to work, they enable us to accomplish extraordinary things. Multifaceted thought processes spark innovation. Multi-talented collaboration harnesses innovation to deliver superior outcomes. Likewise, as part of this culture, IQVIA is committed to ensuring effective equality between women and men, integrating it as a strategic principle in its corporate and human resources policies.