Application Security Architect – Cloud & DevSecOps

Cybersecurity Jobs; Milwaukee (WI); On-site; USD 130,000 - 170,000; Full time

Benefits offered by this job

Health benefits

401k

Dental and vision

Job summary

CliftonLarsonAllen seeks an Application Security Architect to join at the intersection of security design, engineering, DevOps, and cloud security. This onsite role in Milwaukee, WI drives secure design reviews and automates governance across development workflows while building a Cloud Security Posture Management practice.

You will lead risk identification, establish trust boundaries, and connect code, pipeline, and cloud risks to practical controls and outcomes.

Qualifications

• Experience leading secure design reviews for various solution types.
• Ability to review architecture, diagrams, and data flows.
• Strong knowledge of cloud security, DevOps security, and software supply-chain security.

Responsibilities

• Lead secure design reviews for cloud and hybrid solutions.
• Document risks, mitigations, risk owners, exceptions and decisions.
• Develop security standards, templates, baselines and guidance.
• Build Cloud Security Posture Management practice across teams.
• Translate risks into practical security controls and business outcomes.

Skills

CI/CD pipelines

GitHub Actions

Security architecture

Threat modeling

Communication with stakeholders

Education

Bachelor's degree

Tools

Azure

Black Duck Polaris

Infrastructure as code

Container security

Security platform tooling

Job description

The Application Security Architect for CliftonLarsonAllen will operate at the intersection of application security architecture, engineering, DevOps, and cloud security. In this onsite role in Milwaukee, WI, you will help shape how secure design reviews are run and translate that governance into practical automation across development workflows. The position also drives a Cloud Security Posture Management practice that connects people, processes, and technology to ongoing engineering delivery.

Responsibilities

• Lead and participate in secure design reviews for proprietary, commercial, cloud, and hybrid solutions.
• Document identified risks, required mitigations, risk owners, exceptions, and decisions related to residual risk.
• Review system interaction diagrams and detailed logical, functional, physical, and data-flow diagrams.
• Identify trust boundaries, security boundaries, integration points, administrative interfaces, data stores, and external dependencies.
• Develop reusable security standards, assessment patterns, review templates, control baselines, and architectural guidance.
• Establish and build a Cloud Security Posture Management practice by coordinating people, processes, technology, governance, and service expectations.
• Assess cloud permissions, secrets management, deployment architecture, infrastructure as code, container images, orchestration configurations, and cloud-native deployment patterns.
• Find opportunities to prevent configuration issues and policy violations before deployment using policy-as-code, automated validation, and reusable engineering guardrails.
• Provide technical security leadership across Development, Cloud, Platform, Product, Data, Information Technology, Enterprise Architecture, and Risk teams.
• Connect code, pipeline, identity, integration, data, and cloud architecture risks to practical security controls and business outcomes.
• Separate mandatory security requirements from recommendations and risk-based enhancements.
• Escalate unresolved material risks through established risk-acceptance processes.
• Communicate technical risks, required controls, exceptions, ownership, and residual risk to technical and non-technical stakeholders, building partnerships and influencing cross-functional teams without direct authority.

Requirements

• Experience leading or supporting secure design reviews for application, cloud, commercial, and hybrid solutions.
• Experience reviewing technical architecture, system interaction, and data-flow diagrams.
• Experience with application security architecture, cloud security, DevOps security, and security engineering.
• Knowledge of CI/CD pipelines, GitHub Actions and workflows, infrastructure as code, containers, and software supply-chain security.
• Experience assessing cloud permissions, secrets management, deployment architecture, container images, orchestration configurations, and cloud-native deployment patterns.
• Experience connecting technical security risks to practical controls and business outcomes.
• Ability to communicate technical risks and security requirements to both technical and non-technical stakeholders.
• Ability to build relationships and influence cross-functional teams without direct authority.

Technologies

• GitHub Actions; CI/CD pipelines; workflows
• Infrastructure as code; containers
• Software supply-chain security; Cloud Security Posture Management
• Azure cloud services; enterprise cloud identity platforms
• Black Duck Polaris; software composition analysis
• Application security platform
• Policy-as-code; artifact integrity; secrets management
• Automated compliance controls
• NIST security and risk-management frameworks
• API security; integration platforms
• Secure container orchestration patterns
• GitHub Actions and workflows

Benefits

• Comprehensive benefit options including health, dental, vision, 401k, and much more.

Preferred Qualifications

• Professional certification such as CISSP, CCSP, or a comparable security, cloud, DevOps, or architecture credential.
• Experience with Azure cloud services, cloud-native security patterns, and enterprise cloud identity platforms.
• Experience with Black Duck Polaris or a comparable software composition analysis and application security platform.
• Experience with Cloud Security Posture Management, container security, policy-as-code, artifact integrity, secrets management, and automated compliance controls.
• Experience conducting threat modeling, architecture risk analysis, secure design reviews, vulnerability management, and risk-acceptance activities.
• Experience working with NIST security and risk-management frameworks.
• Familiarity with API security, integration platforms, citizen-development governance, and secure container orchestration patterns.

Job Requirements

• 7 years of general IT experience required.
• 4 years with security of IT systems.
• 2 years with security design or strategy.
• Bachelor's degree required; combination of relevant experience, education, and training may be accepted in lieu of degree.