Security Architect with Java exp at Austin, TX urgent

Tech Mirrors; Austin (TX); On-site; USD 83,000 - 103,000; Full time

Job summary

Tech Mirrors seeks a Security Architect to own security architecture and design assurance for enterprise web applications and services. You will define target-state designs, establish reusable secure-design patterns, and act as the design authority for remediation across engineering teams.

The role emphasizes architectural judgement, trust boundaries, identity models, and data-protection design, rather than tool operation or testing. This is a contract position based in Austin, TX.

Qualifications

• 10+ years in application or product security, including design authority roles.
• Experience identifying design-level weaknesses and adopting target-state designs.
• Experience authoring reference architectures or secure-design patterns.

Responsibilities

• Review security architecture of enterprise applications and services.
• Perform threat modelling with engineering teams and derive review plans.
• Identify design-level weaknesses not surfaced by automated tooling.
• Review authentication/authorization architecture (OAuth2/OIDC, token validation).
• Review data-protection design and logging hygiene.
• Define security review standards and scoring models.
• Mentor engineers in architecture-level security review.

Skills

Security architecture

Threat modelling

OAuth2/OIDC

Java/Spring Security

Multi-tenant security

Cloud security

Kubernetes security

OWASP ASVS

Strong written communication

Tools

SAST

SCA

Secrets scanning

Job description

Job Title: Security Architect with Java exp
Location: Austin`, TX
Duration: Contract
Rate : $65/Hr on C2C

Role Summary

We are looking for a Security Architect to own the security architecture and design assurance of enterprise web applications and services. You will review and define application security architecture, identify design-level weaknesses, specify the correct target-state design, and establish reusable secure-design patterns and assurance standards that engineering teams build to.
This is a design-authority role. The emphasis is on architectural judgement - trust boundaries, identity and authorization models, and data-protection design - rather than on tool operation or test execution.

Key Responsibilities

Security architecture and design review

• Review the security architecture of enterprise applications and services: trust boundaries, identity and tenancy models, authorization models, and sensitive-data flows
• Conduct threat modelling (STRIDE or equivalent) with engineering teams and derive prioritized, testable review plans from the model
• Identify design-level weaknesses that automated tooling does not surface - perimeter and gateway bypass, internal-trust assumptions that fail under external exposure, loss of end-user identity across service-to-service hops, and client-side-enforced tenant isolation
• Review authentication and authorization architecture: OAuth2/OIDC usage, token validation completeness, service-to-service authentication, and object- and function-level authorization across roles and tenants
• Review data-protection design: encryption in transit and at rest, key management, secrets handling, and logging hygiene for sensitive data
• Review platform architecture: container and Kubernetes security posture, infrastructure-as-code, and cloud IAM least privilege

Target-state design and patterns

• Specify target-state designs for architectural weaknesses, not problem statements alone
• Develop and publish reusable secure-design patterns and reference architectures for adoption across engineering teams
• Act as the design authority engineering teams consult before implementing security remediation
• Feed systemic recommendations into SDLC and CI/CD controls to prevent recurrence

Assurance and standards

• Define security review standards, assessment criteria and scoring or rating models, and defend them under challenge
• Assess applications against those standards and produce the resulting assurance findings and ratings
• Provide technical direction and quality assurance for a small security review team, including offshore members
• Mentor engineers in architecture-level security review

Stakeholder engagement

• Partner with central information security functions on assessment scope, coverage and findings
• Advise application owners and engineering leads on remediation design and prioritization
• Escalate risks and blockers clearly and early

Required Skills and Experience

• 10+ years in application or product security, including time in a named security architect or design authority role on enterprise systems
• Demonstrable track record of identifying design-level security weaknesses and specifying target-state designs that were adopted
• Experience authoring reference architectures or secure-design patterns used by multiple engineering teams
• Experience on, or running, an architecture or design review board or equivalent design gate
• Threat modelling at architecture level, including facilitating sessions with teams new to the practice
• Java and Spring Boot secure design and code review, including Spring Security and API gateway layers; awareness of reactive/non-blocking codebases
• Identity and access architecture - OAuth2/OIDC, JWT validation, federated enterprise identity providers, service-to-service authentication (HMAC-signed requests, app-to-app token exchange), session and token lifecycle
• Multi-tenant authorization architecture - broken object- and function-level authorization, tenant isolation design and verification
• Cloud and container security architecture - Kubernetes and Helm, container hardening, infrastructure-as-code review, cloud IAM across at least two major providers
• Working knowledge of OWASP ASVS, OWASP Top 10, OWASP API Security Top 10, and CVSS v4.0
• Experience handling confidential or regulated data under a formal classification scheme
• Ability to build the security model of a proprietary or undocumented internal framework from its source code
• Strong written communication - designs, findings and rationale must be actionable by engineers
• Ability to influence without direct authority, and to work credibly with both central security functions and delivery teams

Preferred

• AI / LLM application security architecture - retrieval-augmented generation design, tenant isolation on retrieval, prompt and template provenance, treating model output as untrusted, agent and tool credential scope, Model Context Protocol (MCP) exposure
• Hands-on security testing or penetration testing background, sufficient to validate and demonstrate a finding
• API security architecture and authorization-matrix testing
• Software supply chain, SBOM and dependency risk management
• Experience establishing a security assurance programme where no formal process previously existed
• Familiarity with enterprise CI/CD security gates (SAST, SCA, secrets scanning)

Certifications

Demonstrable architectural depth is weighted above certification. One or more of the following is expected:

• CISSP, CSSLP, CISSP-ISSAP, or SABSA
• Valuable additions: CCSP, CKS, OSCP, GWAPT, or a recognized threat-modelling credential