Lead App Security, SDLC & Architecture

HCL Technologies Limited; United States; On-site; USD 150,000 - 190,000; Full time

Job summary

Sapsf in the United States seeks a Service Owner – Application Security, SDLC & Security Architecture to lead enterprise security capabilities across R&D, Commercial, and Corporate applications.

You will drive secure SDLC, security architecture reviews, testing standards, and governance, partnering with developers and stakeholders to embed security across the lifecycle and meet regulatory requirements such as HIPAA where applicable.

Qualifications

• 10+ years of experience in application security, cybersecurity, software engineering, or security architecture.
• Experience owning enterprise application security capabilities across multiple business domains.
• Experience supporting application portfolios within complex organizations, including R&D, Commercial, and Corporate environments.
• Strong understanding of Secure SDLC practices, Security architecture reviews, Application security testing methodologies, Vulnerability management, DevSecOps principles, Application risk management.
• Experience partnering with development teams, architects, and business stakeholders.
• Experience defining security standards, governance processes, and operating models.
• Experience working in regulated environments; healthcare experience and knowledge of HIPAA/security controls is preferred.

Responsibilities

• Define and maintain the enterprise application security strategy, roadmap, and future-state capability model.
• Own and continuously improve secure SDLC practices across R&D, Commercial, and Corporate application environments.
• Establish security governance processes for application development, enhancement, and support activities.
• Own the security architecture review process and provide governance for application security design decisions.
• Partner with solution architects, application owners, developers, and business stakeholders to identify security risks and recommend appropriate security controls.
• Define and govern application security testing practices, including: Security assessments, Vulnerability testing, Application security reviews, Penetration testing coordination, Security validation activities.
• Establish application security standards, documentation requirements, and reusable security patterns.
• Support application teams throughout the application lifecycle, including design, development, implementation, and ongoing support.
• Evaluate application security tools and recommend improvements to enhance security effectiveness and developer experience.
• Drive adoption of secure engineering practices and security-by-design principles.
• Define service KPIs, maturity objectives, and continuous improvement initiatives.
• Ensure application security capabilities align with regulatory, privacy, and healthcare requirements, including HIPAA where applicable.

Job description

Career Opportunities: Service Owner - Application Security, SDLC & Security Architecture (162851)

Requisition ID162851-Posted10/14/2026

The Service Owner – Application Security, SDLC & Security Architecture is accountable for the strategy, governance, architecture alignment, and continuous improvement of enterprise application security capabilities across Research & Development, Commercial, and Corporate application portfolios. The role owns the application security roadmap, secure software development lifecycle (SDLC) practices, security architecture review processes, application security testing standards, and security support model. The Service Owner ensures applications are designed, developed, tested, and operated securely while enabling business teams to deliver secure solutions efficiently. The role partners with application development teams, solution architects, cybersecurity teams, business stakeholders, and technology teams to embed security throughout the application lifecycle. Key Responsibilities • Define and maintain the enterprise application security strategy, roadmap, and future-state capability model. • Own and continuously improve secure SDLC practices across R&D, Commercial, and Corporate application environments. • Establish security governance processes for application development, enhancement, and support activities. • Own the security architecture review process and provide governance for application security design decisions. • Partner with solution architects, application owners, developers, and business stakeholders to identify security risks and recommend appropriate security controls. • Define and govern application security testing practices, including: o Security assessments o Vulnerability testing o Application security reviews o Penetration testing coordination o Security validation activities • Establish application security standards, documentation requirements, and reusable security patterns. • Support application teams throughout the application lifecycle, including design, development, implementation, and ongoing support. • Evaluate application security tools and recommend improvements to enhance security effectiveness and developer experience. • Drive adoption of secure engineering practices and security-by-design principles. • Define service KPIs, maturity objectives, and continuous improvement initiatives. • Ensure application security capabilities align with regulatory, privacy, and healthcare requirements, including HIPAA where applicable. Required Skills & Experience • 10+ years of experience in application security, cybersecurity, software engineering, or security architecture. • Experience owning enterprise application security capabilities across multiple business domains. • Experience supporting application portfolios within complex organizations, including R&D, Commercial, and Corporate environments. • Strong understanding of: o Secure SDLC practices o Security architecture reviews o Application security testing methodologies o Vulnerability management o DevSecOps principles o Application risk management • Experience partnering with development teams, architects, and business stakeholders. • Experience defining security standards, governance processes, and operating models. • Experience working in regulated environments; healthcare experience and knowledge of HIPAA/security controls is preferred.

Key Responsibilities

The Service Owner – Application Security, SDLC & Security Architecture is accountable for the strategy, governance, architecture alignment, and continuous improvement of enterprise application security capabilities across Research & Development, Commercial, and Corporate application portfolios. The role owns the application security roadmap, secure software development lifecycle (SDLC) practices, security architecture review processes, application security testing standards, and security support model. The Service Owner ensures applications are designed, developed, tested, and operated securely while enabling business teams to deliver secure solutions efficiently. The role partners with application development teams, solution architects, cybersecurity teams, business stakeholders, and technology teams to embed security throughout the application lifecycle. Key Responsibilities • Define and maintain the enterprise application security strategy, roadmap, and future-state capability model. • Own and continuously improve secure SDLC practices across R&D, Commercial, and Corporate application environments. • Establish security governance processes for application development, enhancement, and support activities. • Own the security architecture review process and provide governance for application security design decisions. • Partner with solution architects, application owners, developers, and business stakeholders to identify security risks and recommend appropriate security controls. • Define and govern application security testing practices, including: o Security assessments o Vulnerability testing o Application security reviews o Penetration testing coordination o Security validation activities • Establish application security standards, documentation requirements, and reusable security patterns. • Support application teams throughout the application lifecycle, including design, development, implementation, and ongoing support. • Evaluate application security tools and recommend improvements to enhance security effectiveness and developer experience. • Drive adoption of secure engineering practices and security-by-design principles. • Define service KPIs, maturity objectives, and continuous improvement initiatives. • Ensure application security capabilities align with regulatory, privacy, and healthcare requirements, including HIPAA where applicable. Required Skills & Experience • 10+ years of experience in application security, cybersecurity, software engineering, or security architecture. • Experience owning enterprise application security capabilities across multiple business domains. • Experience supporting application portfolios within complex organizations, including R&D, Commercial, and Corporate environments. • Strong understanding of: o Secure SDLC practices o Security architecture reviews o Application security testing methodologies o Vulnerability management o DevSecOps principles o Application risk management • Experience partnering with development teams, architects, and business stakeholders. • Experience defining security standards, governance processes, and operating models. • Experience working in regulated environments; healthcare experience and knowledge of HIPAA/security controls is preferred.

Skill Requirements

The Service Owner – Application Security, SDLC & Security Architecture is accountable for the strategy, governance, architecture alignment, and continuous improvement of enterprise application security capabilities across Research & Development, Commercial, and Corporate application portfolios. The role owns the application security roadmap, secure software development lifecycle (SDLC) practices, security architecture review processes, application security testing standards, and security support model. The Service Owner ensures applications are designed, developed, tested, and operated securely while enabling business teams to deliver secure solutions efficiently. The role partners with application development teams, solution architects, cybersecurity teams, business stakeholders, and technology teams to embed security throughout the application lifecycle. Key Responsibilities • Define and maintain the enterprise application security strategy, roadmap, and future-state capability model. • Own and continuously improve secure SDLC practices across R&D, Commercial, and Corporate application environments. • Establish security governance processes for application development, enhancement, and support activities. • Own the security architecture review process and provide governance for application security design decisions. • Partner with solution architects, application owners, developers, and business stakeholders to identify security risks and recommend appropriate security controls. • Define and govern application security testing practices, including: o Security assessments o Vulnerability testing o Application security reviews o Penetration testing coordination o Security validation activities • Establish application security standards, documentation requirements, and reusable security patterns. • Support application teams throughout the application lifecycle, including design, development, implementation, and ongoing support. • Evaluate application security tools and recommend improvements to enhance security effectiveness and developer experience. • Drive adoption of secure engineering practices and security-by-design principles. • Define service KPIs, maturity objectives, and continuous improvement initiatives. • Ensure application security capabilities align with regulatory, privacy, and healthcare requirements, including HIPAA where applicable. Required Skills & Experience • 10+ years of experience in application security, cybersecurity, software engineering, or security architecture. • Experience owning enterprise application security capabilities across multiple business domains. • Experience supporting application portfolios within complex organizations, including R&D, Commercial, and Corporate environments. • Strong understanding of: o Secure SDLC practices o Security architecture reviews o Application security testing methodologies o Vulnerability management o DevSecOps principles o Application risk management • Experience partnering with development teams, architects, and business stakeholders. • Experience defining security standards, governance processes, and operating models. • Experience working in regulated environments; healthcare experience and knowledge of HIPAA/security controls is preferred.

Other Requirements

The Service Owner – Application Security, SDLC & Security Architecture is accountable for the strategy, governance, architecture alignment, and continuous improvement of enterprise application security capabilities across Research & Development, Commercial, and Corporate application portfolios. The role owns the application security roadmap, secure software development lifecycle (SDLC) practices, security architecture review processes, application security testing standards, and security support model. The Service Owner ensures applications are designed, developed, tested, and operated securely while enabling business teams to deliver secure solutions efficiently. The role partners with application development teams, solution architects, cybersecurity teams, business stakeholders, and technology teams to embed security throughout the application lifecycle. Key Responsibilities • Define and maintain the enterprise application security strategy, roadmap, and future-state capability model. • Own and continuously improve secure SDLC practices across R&D, Commercial, and Corporate application environments. • Establish security governance processes for application development, enhancement, and support activities. • Own the security architecture review process and provide governance for application security design decisions. • Partner with solution architects, application owners, developers, and business stakeholders to identify security risks and recommend appropriate security controls. • Define and govern application security testing practices, including: o Security assessments o Vulnerability testing o Application security reviews o Penetration testing coordination o Security validation activities • Establish application security standards, documentation requirements, and reusable security patterns. • Support application teams throughout the application lifecycle, including design, development, implementation, and ongoing support. • Evaluate application security tools and recommend improvements to enhance security effectiveness and developer experience. • Drive adoption of secure engineering practices and security-by-design principles. • Define service KPIs, maturity objectives, and continuous improvement initiatives. • Ensure application security capabilities align with regulatory, privacy, and healthcare requirements, including HIPAA where applicable. Required Skills & Experience • 10+ years of experience in application security, cybersecurity, software engineering, or security architecture. • Experience owning enterprise application security capabilities across multiple business domains. • Experience supporting application portfolios within complex organizations, including R&D, Commercial, and Corporate environments. • Strong understanding of: o Secure SDLC practices o Security architecture reviews o Application security testing methodologies o Vulnerability management o DevSecOps principles o Application risk management • Experience partnering with development teams, architects, and business stakeholders. • Experience defining security standards, governance processes, and operating models. • Experience working in regulated environments; healthcare experience and knowledge of HIPAA/security controls is preferred.