Senior App Security Architect – Cloud, AI & PHI

IQVIA; Porto; Hybrid; EUR 70,000 - 100,000; Full time

Job summary

IQVIA is seeking an experienced Application Security Architect to protect PHI and sensitive client data across healthcare applications, APIs, data exchanges, and cloud services. You will work with global teams to design safeguards, influence Secure SDLC and AIDLC, and drive risk-based reviews throughout development and deployment in AWS environments.

You will lead threat modeling, define validation and testing requirements, and provide architectural guidance for vulnerability management, CI/CD

Qualifications

• 6+ years of progressive experience in application security or related field.
• Experience threat modeling, data flow mapping, and translating threats into requirements.
• Knowledge of Secure SDLC, AIDLC, CI/CD security, SAST/SCA/DAST, and AI security considerations.
• Experience with AWS architecture, OWASP frameworks, HIPAA/HITRUST/SOC 2/CIS/NIST standards.

Responsibilities

• Establish risk-based review criteria for new applications, AI features, and infrastructure; document decisions and evidence.
• Lead threat modeling for applications, APIs, data flows, and AI-enabled features; translate threats into design requirements.
• Provide architectural guidance for testing, vulnerability management, and risk-based release criteria.
• Align Cedar Gate patterns with IQVIA security architecture requirements.

Skills

Threat modeling

Secure SDLC

AIDLC

CI/CD security

SAST

SCA

DAST

API security

AWS

OWASP ASVS

HIPAA

PHI processing

Multi-tenant SaaS

cryptography

Education

Bachelor’s degree in a related field

Tools

AWS

Job description

IQVIA is seeking an experienced Application Security Architect to protect PHI and sensitive client data across healthcare applications, APIs, data exchanges, and cloud services. You will work with global teams to design safeguards, influence Secure SDLC and AIDLC, and drive risk-based reviews throughout development and deployment in AWS environments.

You will lead threat modeling, define validation and testing requirements, and provide architectural guidance for vulnerability management, CI/CD