Application Security Architect + AI

EPAM Systems; United States; Remote; USD 140,000 - 190,000; Full time

Job summary

EPAM Systems Inc. seeks an experienced Application Security Architect to design robust security architectures for enterprise applications and APIs, leveraging AI-assisted tools to enhance practices.

You will collaborate across engineering, DevOps, cloud and compliance teams to embed security throughout the software development lifecycle, including SSDLC and secure-by-design principles.

Qualifications

• Bachelor's degree or equivalent practical experience in CS, cybersecurity, or engineering.
• 5+ years of information security with focus on application security architecture or secure development.
• Experience delivering or contributing to app security architecture and DevSecOps.
• Expertise in identifying vulnerabilities, risks and controls.
• Understanding of OWASP Top 10 and secure coding practices.
• Knowledge of cloud security, IAM, network security and data protection.

Responsibilities

• Design and implement security architectures for enterprise apps, APIs, microservices and cloud-native apps.
• Gather requirements to design secure solutions for migrations and new implementations.
• Define and improve authentication, authorization, encryption and secrets management.
• Conduct threat modeling, risk analysis and secure design assessments.
• Develop security reference architectures, standards and design patterns.
• Support SSDLC and DevSecOps integration across engineering teams.
• Evaluate SAST/DAST/SCA, secrets scanning and vulnerability management.
• Review vulnerabilities, identify weaknesses and propose remediation.
• Collaborate with DevOps, cloud, IAM, security ops and compliance teams.
• Leverage AI-assisted tools for threat modeling, vulnerability analysis and secure code review.
• Communicate risks and remediation plans to stakeholders and security leadership.

Skills

Application security architecture

Threat modeling

SSDLC / DevSecOps

SAST / DAST / SCA

Vulnerability management

Cloud security

API security

Authentication & authorization

Programming basics (Python/Java/C#)

Security tooling integration

Education

Bachelor's degree in Computer Science, Cybersecurity, Engineering, or equivalent practical experience

Tools

Snyk

Checkmarx

Veracode

Job description

We are seeking an experienced Application Security Architect with a passion for AI-driven security innovation to join our team. In this role, you will design and implement robust security architectures for enterprise applications while leveraging AI-assisted tools to enhance application security practices. You will collaborate across engineering, DevOps, cloud and compliance teams to embed security into every stage of the software development lifecycle.

Responsibilities

• Design and implement security architectures and controls for enterprise applications, APIs, microservices and cloud-native applications
• Gather business, technical and compliance requirements to design secure application solutions for new implementations, migrations and security improvements
• Define and improve application security capabilities, including authentication, authorization, API security, encryption, secrets management and secure configuration
• Conduct security architecture reviews, threat modeling, secure design assessments and application security risk analysis
• Develop application security reference architectures, security standards, secure design patterns and secure development guidelines
• Support Secure Software Development Lifecycle (SSDLC), secure-by-design principles and DevSecOps integration across engineering teams
• Evaluate and improve application security technologies and processes, including SAST, DAST, SCA, secrets scanning and vulnerability management
• Review application security vulnerabilities, identify architectural weaknesses and recommend appropriate remediation strategies
• Collaborate with development, DevOps, cloud, infrastructure, IAM, security operations and compliance teams to integrate security into application design and development
• Leverage AI-assisted tools and workflows to improve application security activities such as threat modeling, vulnerability assessment, secure code review, compliance analysis, security scripting and workflow automation
• Identify opportunities for AI-assisted application security automation while ensuring appropriate validation, data protection and human oversight
• Communicate application security risks, architectural decisions and remediation plans to stakeholders and security leadership

Requirements

• Bachelor's degree in Computer Science, Cybersecurity, Engineering, or equivalent practical experience
• 5+ years of information security experience, with a focus on application security architecture, secure application design or application security engineering
• Background in delivering or significantly contributing to application security architecture, secure development, DevSecOps integration or application security improvement projects
• Expertise in application security, including identifying vulnerabilities, assessing security risks and recommending technical security controls
• Understanding of application security principles, OWASP Top 10, secure coding practices, API security, authentication, authorization and common vulnerability mitigation techniques
• Proficiency in application security architecture reviews, threat modeling, secure design assessments or security risk analysis
• Familiarity with application security tools and technologies such as SAST, DAST, SCA or secrets scanning solutions
• Knowledge of Secure SDLC, DevSecOps, CI/CD security and secure-by-design principles
• Working knowledge of at least one programming language such as Python, Java or C# (or JavaScript/TypeScript, Go), sufficient to review code and assess application security risks
• Competency in related security domains, including cloud security, IAM, network security, data protection and security operations
• Understanding of security architecture frameworks such as Zero Trust, NIST, ISO 27001 or OWASP guidelines
• Skills in application security automation, scripting and security tooling integration
• Intermediate practical experience with AI-assisted tools and automation, including using AI for vulnerability analysis and threat modeling, applying structured prompting, generating and validating scripts or secure code recommendations, simplifying repetitive workflows and configuring AI-assisted integrations
• Understanding of safe AI usage, including data protection, access control and validation of AI-generated outputs, with willingness to further develop AI automation skills
• Strong communication, collaboration and hands-on technical skills

Nice to have

• Experience with application security platforms such as Snyk, Checkmarx or Veracode (or SonarQube, Semgrep, GitHub Advanced Security, Burp Suite, OWASP ZAP)
• Background in application security architecture for cloud-native applications, microservices, containers and Kubernetes environments
• Familiarity with threat modeling methodologies and tools such as STRIDE, OWASP Threat Dragon or Microsoft Threat Modeling Tool
• Skills in DevSecOps, CI/CD security automation, Infrastructure as Code scanning and policy-as-code solutions
• Knowledge of software supply chain security, SBOM, dependency management and third-party component security
• Expertise in API security, OAuth 2.0, OpenID Connect, secrets management and secure application authentication patterns
• Capability to integrate application security findings with SIEM/SOAR, ticketing or vulnerability management platforms
• Proficiency in AI automation tools such as AI agents, Microsoft Copilot Studio, Azure OpenAI (or Amazon Bedrock, LangChain, Power Automate)
• Understanding of AI application security risks, including prompt injection, data leakage, insecure output handling and excessive AI agent permissions
• Familiarity with OWASP Top 10 for LLM Applications or similar AI security guidelines
• Security certifications such as CSSLP, CISSP, CISM (or CCSP, GWAPT, GWEB, OSCP, OSWE)
• AI-related certifications such as AI-900 or AWS Certified AI Practitioner