Hybrid Application Security Architect: Enterprise & Cloud

Ampcus, Inc; Richmond (VA); Hybrid; USD 140,000 - 190,000; Full time

Benefits offered by this job

Onsite 4 days/week

Job summary

Ampcus Inc. is seeking an experienced Application Security Architect to define and oversee security strategies across enterprise IT initiatives in a hybrid Richmond, VA environment.

You will drive SSDLC across web, API, microservices, and cloud-native systems, lead threat modeling, enforce data protection, and ensure compliance with security standards. Bachelor's degree and CISSP/CSSLP/GIAC or equivalent are highly desired.

Qualifications

• Bachelor's degree in computer science, cybersecurity, engineering, or a related field or equivalent practical experience.
• 10+ years in software engineering, application security, security engineering, or related technical roles, including 2+ years designing security architecture for systems.
• Strong understanding of secure software-development principles and common application risks, including the OWASP Top 10, insecure authorization, injection, deserialization and API abuse.

Responsibilities

• Define application-security architecture principles, standards, patterns, reference implementations, and guardrails for web, mobile, API, microservice, and cloud-native systems.
• Perform architecture and design reviews, identify trust boundaries, attack paths, data flows, security gaps, and compensating controls.
• Lead or facilitate threat modeling for new applications, major features, integrations, and high-risk changes.
• Establish repeatable security requirements for authentication, authorization, session management, encryption, secrets management, logging, privacy, API protection, and data protection.
• Partner with software engineers to integrate security throughout the SDLC, including code review, CI/CD pipelines, infrastructure as code, testing, release approval, and production monitoring.
• Evaluate and guide use of security tools such as SAST, DAST, software composition analysis, container/image scanning, API security testing, secret scanning, and runtime protection.
• Define a vulnerability-management approach for applications and dependencies, including severity criteria, remediation SLAs, exception processes, and verification of fixes.

Skills

Security architecture

Threat modeling

OAuth 2.0/OpenID Connect

IAM/RBAC

Cloud security

DevSecOps

OWASP Top 10

Communication

Education

Bachelor's degree in CS or related

Tools

SAST/DAST tools

Azure

SQL Server

Purview

Kubernetes

DLP

Job description

Ampcus Inc. is seeking an experienced Application Security Architect to define and oversee security strategies across enterprise IT initiatives in a hybrid Richmond, VA environment.

You will drive SSDLC across web, API, microservices, and cloud-native systems, lead threat modeling, enforce data protection, and ensure compliance with security standards. Bachelor's degree and CISSP/CSSLP/GIAC or equivalent are highly desired.