Senior App Sec Architect: SSDLC & Data Privacy

TALENT Software Services; Richmond (VA); Hybrid; USD 140,000 - 180,000; Full time

Job summary

VDOT seeks an Application Security Architect to define and oversee security strategies across enterprise IT initiatives. The role drives SSDLC across a hybrid ecosystem, spanning web apps, cloud-native systems, GIS platforms, and low-code/no-code solutions, while leading data-protection and privacy posture.

You will guide threat modeling, security reviews, and architecture decisions, partnering with development and cybersecurity teams to embed security throughout the lifecycle and maintain

Qualifications

• Bachelor's degree or equivalent practical experience.
• 10 years in software engineering or security roles, including 2 years designing security architecture.
• Knowledge of OWASP Top 10 and secure coding practices.

Responsibilities

• Define application-security architecture principles and guardrails for web, mobile, API, and cloud systems.
• Perform architecture reviews, identify gaps, and enforce security controls across the SDLC.
• Lead threat modeling for new apps and high-risk changes.
• Establish security requirements for authentication, encryption, logging, and data protection.
• Collaborate with engineers to embed security in CI/CD, IaC, testing, and production monitoring.
• Evaluate SAST/DAST, SCA, container security, and API testing tools.

Skills

Threat modeling

Secure SDLC

Security architecture

Data protection

Cloud security

Communication with engineers

OAuth/OpenID Connect

IAM / MFA / SSO

Kubernetes security

API security

Education

Bachelor's degree in computer science, cybersecurity, engineering, or related field

Tools

Azure

SQL Server

Dynamics 365

Power Platform

ArcGIS

Microsoft Purview

Job description

VDOT seeks an Application Security Architect to define and oversee security strategies across enterprise IT initiatives. The role drives SSDLC across a hybrid ecosystem, spanning web apps, cloud-native systems, GIS platforms, and low-code/no-code solutions, while leading data-protection and privacy posture.

You will guide threat modeling, security reviews, and architecture decisions, partnering with development and cybersecurity teams to embed security throughout the lifecycle and maintain