Application Security Architect with AI

EPAM Systems; Turkey; On-site; TRY 4,014,000 - 6,021,000; Full time

Benefits offered by this job

Continuous upskilling

English courses

Private health insurance

Referral bonuses

Job summary

EPAM Systems Inc. seeks an experienced Application Security Architect to design robust security architectures for enterprise applications, APIs and cloud-native systems.

You will drive threat modeling, secure-by-design practices and SSDLC adoption across engineering teams, while collaborating with DevOps, cloud and compliance groups. You will leverage AI-assisted tools to enhance vulnerability assessment, code review and risk analysis, ensuring data protection and proper human oversight.

Qualifications

• 5+ years in information security focusing on application security architecture.
• Experience in secure design reviews, threat modeling and risk analysis.
• Strong knowledge of OWASP Top 10 and API security patterns.

Responsibilities

• Design and implement security architectures for enterprise apps, APIs and microservices.
• Lead threat modeling, secure design assessments and SSDLC improvements.
• Collaborate across engineering, DevOps, cloud, IAM and compliance teams.
• Evaluate and optimize SAST/DAST/SCA and vulnerability management processes.
• Lead AI-assisted security initiatives and automation while ensuring data protection.

Skills

Application security architecture

Threat modeling

DevSecOps

CI/CD security

Secure coding

API security

Scripting

AI-assisted security

Communication

Education

Bachelor's degree in CS / Cybersecurity / Engineering

Tools

SAST

DAST

SCA

Secrets scanning

CI/CD tooling

Snyk/Checkmarx/Veracode

Job description

We are seeking an experienced Application Security Architect with a passion for AI-driven security innovation to join our team.In this role, you will design and implement robust security architectures for enterprise applications while leveraging AI-assisted tools to enhance application security practices. You will collaborate across engineering, DevOps, cloud and compliance teams to embed security into every stage of the software development lifecycle.ResponsibilitiesDesign and implement security architectures and controls for enterprise applications, APIs, microservices and cloud-native applicationsGather business, technical and compliance requirements to design secure application solutions for new implementations, migrations and security improvementsDefine and improve application security capabilities, including authentication, authorization, API security, encryption, secrets management and secure configurationConduct security architecture reviews, threat modeling, secure design assessments and application security risk analysisDevelop application security reference architectures, security standards, secure design patterns and secure development guidelinesSupport Secure Software Development Lifecycle (SSDLC), secure-by-design principles and DevSecOps integration across engineering teamsEvaluate and improve application security technologies and processes, including SAST, DAST, SCA, secrets scanning and vulnerability managementReview application security vulnerabilities, identify architectural weaknesses and recommend appropriate remediation strategiesCollaborate with development, DevOps, cloud, infrastructure, IAM, security operations and compliance teams to integrate security into application design and developmentLeverage AI-assisted tools and workflows to improve application security activities such as threat modeling, vulnerability assessment, secure code review, compliance analysis, security scripting and workflow automationIdentify opportunities for AI-assisted application security automation while ensuring appropriate validation, data protection and human oversightCommunicate application security risks, architectural decisions and remediation plans to stakeholders and security leadershipRequirementsBachelor's degree in Computer Science, Cybersecurity, Engineering, or equivalent practical experience5+ years of information security experience, with a focus on application security architecture, secure application design or application security engineeringBackground in delivering or significantly contributing to application security architecture, secure development, DevSecOps integration or application security improvement projectsExpertise in application security, including identifying vulnerabilities, assessing security risks and recommending technical security controlsUnderstanding of application security principles, OWASP Top 10, secure coding practices, API security, authentication, authorization and common vulnerability mitigation techniquesProficiency in application security architecture reviews, threat modeling, secure design assessments or security risk analysisFamiliarity with application security tools and technologies such as SAST, DAST, SCA or secrets scanning solutionsKnowledge of Secure SDLC, DevSecOps, CI/CD security and secure-by-design principlesWorking knowledge of at least one programming language such as Python, Java or C# (or JavaScript/TypeScript, Go), sufficient to review code and assess application security risksCompetency in related security domains, including cloud security, IAM, network security, data protection and security operationsUnderstanding of security architecture frameworks such as Zero Trust, NIST, ISO 27001 or OWASP guidelinesSkills in application security automation, scripting and security tooling integrationIntermediate practical experience with AI-assisted tools and automation, including using AI for vulnerability analysis and threat modeling, applying structured prompting, generating and validating scripts or secure code recommendations, simplifying repetitive workflows and configuring AI-assisted integrationsUnderstanding of safe AI usage, including data protection, access control and validation of AI-generated outputs, with willingness to further develop AI automation skillsStrong communication, collaboration and hands-on technical skillsNice to haveExperience with application security platforms such as Snyk, Checkmarx or Veracode (or SonarQube, Semgrep, GitHub Advanced Security, Burp Suite, OWASP ZAP)Background in application security architecture for cloud-native applications, microservices, containers and Kubernetes environmentsFamiliarity with threat modeling methodologies and tools such as STRIDE, OWASP Threat Dragon or Microsoft Threat Modeling ToolSkills in DevSecOps, CI/CD security automation, Infrastructure as Code scanning and policy-as-code solutionsKnowledge of software supply chain security, SBOM, dependency management and third-party component securityExpertise in API security, OAuth 2.0, OpenID Connect, secrets management and secure application authentication patternsCapability to integrate application security findings with SIEM/SOAR, ticketing or vulnerability management platformsProficiency in AI automation tools such as AI agents, Microsoft Copilot Studio, Azure OpenAI (or Amazon Bedrock, LangChain, Power Automate)Understanding of AI application security risks, including prompt injection, data leakage, insecure output handling and excessive AI agent permissionsFamiliarity with OWASP Top 10 for LLM Applications or similar AI security guidelinesSecurity certifications such as CSSLP, CISSP, CISM (or CCSP, GWAPT, GWEB, OSCP, OSWE)AI-related certifications such as AI-900 or AWS Certified AI PractitionerWe offerCONTINUOUS UPSKILLING, LEARNING & DEVELOPMENTDiversity of tasks and projectsAssessment center for objective review of competency levelPersonal development planMentoring programs and leadership developmentCertification and professional development supportAccess to learning platforms including more than 2,500 internal coursesEnglish courses taught by certified teachersCORPORATE BENEFITSExtra leave daysReferral bonusesCOMPENSATION PACKAGECompetitive compensation paid in USDRegular salary and performance reviewsMEDICAL & HEALTHCAREPrivate health insuranceWell-being eventsWORKING ENVIRONMENTRecreation areas and kitchensTea, coffee and snacksSports equipment and game consolesIT EquipmentMicrosoft’s Software Assurance Home Use Program (HUP)Please note that our Talent Attraction Team reviews applications and CVs submitted in English.EPAM is global leader in AI transformation engineering and integrated consulting, serving Forbes Global 2000 companies and ambitious startups. With over thirty years of expertise in custom software, product and platform engineering, we empower our clients to become AI-Native enterprises, driving measurable value from innovation and digital investments.