Application Security Architect

IQVIA; Porto Salvo; On-site; EUR 90,000 - 130,000; Full time

Job summary

IQVIA is seeking an Application Security Architect to protect PHI and sensitive client data across healthcare applications, APIs, and cloud services. You will work embedded with Cedar Gate teams in Portugal, Nepal, and the United States, influencing Secure SDLC and AI guardrails while balancing engineering ownership and security governance.

Based in Portugal, you will lead risk-based reviews, threat modeling, and architecture decisions, ensuring secure design patterns and compliance with HIPAA,

Qualifications

• 6+ years in application security or related fields.
• Experience threat modeling, data flows, and risk-based requirements.
• Knowledge of SAST, SCA, DAST, API security, and IAM concepts.
• Familiarity with OWASP ASVS, NIST, HIPAA/SOC 2 controls.

Responsibilities

• Lead threat modeling for applications, APIs, and data flows.
• Define validation requirements for AI-generated code and AI-enabled apps.
• Provide architectural guidance for testing, vulnerability management, and risk reduction.
• Align Cedar Gate patterns with IQVIA security standards and governance.

Skills

Threat modeling

Application security

Cloud security

Secure SDLC

CI/CD security

Security governance

Education

Bachelor’s degree in a related field

Job description

Application Security Architect Location: Portugal Role and Responsibilities Protecting Personal Health Information (PHI) and other sensitive client data is a core responsibility of this position. The Application Security Architect will work with Cedar Gate application teams, who are based both in Nepal and the United States, to design and improve safeguards across healthcare applications, APIs, data exchanges, cloud services, and supporting infrastructure. This senior, hands-on role is an embedded design and risk advisor for Cedar Gate product, development, engineering, DevOps, and infrastructure teams where all services are hosted in AWS or Snowflake. Based in Portugal and reporting to the Cedar Gate Associate Director, Security, the architect will support new applications, functionality, material changes, and technology modernization. The role will influence Cedar Gate’s Secure SDLC and AIDLC, while engineering retains solution ownership and application security analysts perform routine testing, tooling, triage, and remediation tracking.

Principal responsibilities include:

• Establish risk-based review criteria for new applications, functionality, material changes, AI features, and supporting infrastructure; perform complex reviews and document requirements, decisions, exceptions, and closure evidence. Identify systemic weaknesses and modernization priorities.
• Lead threat modeling for applications, APIs, administrative functions, sensitive data flows, trust boundaries, and AI-enabled features using STRIDE, misuse cases, and attack-path analysis; translate threats into design requirements.
• Maintain reusable application security patterns, architecture decision records, and guidance for identity, tenant isolation, input and file handling, cryptography, secrets, logging, PHI workflows, APIs, OAuth 2.0, OpenID Connect, and service communications.
• Influence the Secure SDLC and AIDLC through architecture gates, threat-modeling criteria, secure coding and AI guardrails, testing requirements, and risk-based release criteria. Address prompt injection, data leakage, insecure tool or output use, excessive agency, authorization bypass, and improper use of PHI, source code, or credentials.
• Define validation requirements for AI-generated code and AI-enabled applications, including developer review, provenance and licensing, secrets and dependency scanning, SAST, SCA, DAST, API, container, infrastructure-as-code, and pre-production testing; analysts execute routine reviews.
• Provide architectural guidance and escalation for testing, vulnerability management, supply-chain risk, penetration testing, and high-risk findings. Present design recommendations, tradeoffs, and remediation strategies to engineering, product, security leadership, and governance forums.
• Provide senior architectural review to Nepal application and cloud security personnel for complex reviews, threat models, AI assessments, risk decisions, and systemic findings without duplicating analyst work. Align Cedar Gate patterns with IQVIA security architecture requirements.

Required Experience and Qualifications

• 6 or more years of progressive experience in application security, software engineering, product security, cloud security, security engineering, or application security architecture; 6-8 years of directly relevant experience is preferred.
• Experience reviewing new and existing application architectures, conducting threat modeling, documenting sensitive data flows and trust boundaries, and translating threats into practical requirements; strong knowledge of application and API security, multi-tenant SaaS, identity, cryptography, secrets, logging, supply-chain risk, and PHI processing.
• Experience influencing Secure SDLC and AIDLC practices, defining risk-based review and release criteria, and embedding security into CI/CD. Knowledge of SAST, SCA, DAST, API, secrets, container, infrastructure-as-code, and penetration testing; experience evaluating generated code, AI assistants, agents, LLM integrations, and sensitive-data handling is required.
• Working knowledge of application-facing AWS architecture and relevant standards, including OWASP ASVS, OWASP Top 10, OWASP API Security Top 10, OWASP SAMM, OWASP LLM guidance, NIST Secure Software Development Framework, MITRE CWE, HIPAA, HITRUST, SOC 2, CIS, and NIST requirements.
• Strong analytical and communication skills; ability to work predominantly during U.S. business hours with teams in the United States, Nepal, Portugal, and other IQVIA locations; fluent English; bachelor’s degree in a related field or equivalent practical experience.

Preferred Experience

• Healthcare SaaS, PHI exchange, analytics, managed file transfer or sFTP, and multi-tenant platforms.
• Hands-on development or DevOps experience; integration of an acquired business into enterprise AppSec practices
• CSSLP, CISSP, CCSP, GIAC Web Application Defender, or relevant AWS certification.

IQVIA is a leading global provider of clinical research services, commercial insights, and healthcare intelligence to the life sciences and healthcare industries. We create intelligent connections to accelerate the development and commercialization of innovative medical treatments to help improve patient outcomes and population health worldwide. Learn more at https://jobs.iqvia.com. IQVIA is committed to integrity in our hiring process and maintains a zero tolerance policy for candidate fraud. All information and credentials submitted in your application must be truthful and complete. Any false statements, misrepresentations, or material omissions during the recruitment process will result in immediate disqualification of your application, or termination of employment if discovered later, in accordance with applicable law. We appreciate your honesty and professionalism.

At IQVIA, we believe that diversity, inclusion, and belonging empower our mission to accelerate innovation for a healthier world. We create a culture of belonging by valuing the perspectives of all talented employees worldwide and providing them with the opportunity to power smarter healthcare for everyone, everywhere. When our talented employees bring their authentic selves and their diverse experiences to work, they enable us to accomplish extraordinary things. Multifaceted thought processes spark innovation. Multi-talented collaboration harnesses innovation to deliver superior outcomes. Likewise, as part of this culture, IQVIA is committed to ensuring effective equality between women and men, integrating it as a strategic principle in its corporate and human resources policies.

IQVIA is a leading global provider of clinical research services, commercial insights and healthcare intelligence to the life sciences and healthcare industries. We create connections that accelerate the development and commercialization of innovative medical treatments. Everything we do is part of a journey to improve patient outcomes and population health worldwide. To get there, we seek out diverse talent with curious minds and a relentless commitment to innovation and impact. No matter your role, everyone at IQVIA contributes to our shared goal of helping customers improve the lives of patients everywhere. Thank you for your interest in growing your career with us.