Senior Application Security Architect

Cybersecurity Jobs; Richmond (VA); Hybrid; USD 90,000 - 96,000; Part time

Benefits offered by this job

401(k) matching

Dental insurance

Health insurance

Vision insurance

Job summary

MasterApp Labs is seeking a Senior Application Security Architect to shape and operationalize application-security architecture principles across web, mobile, API, microservices, and cloud-native systems. This contract role is based in Richmond, VA with hybrid expectations, including onsite presence during an initial 90-day probationary period.

You will define guardrails, lead security reviews, and partner with engineering to embed security across the development lifecycle, covering

Qualifications

• Bachelor's degree or equivalent practical experience in CS/cybersecurity/engineering.
• 10+ years in software engineering or security roles, with 2+ years designing security architecture for systems.
• Strong knowledge of secure software development and OWASP Top 10.
• Experience securing APIs, web apps, cloud platforms, and CI/CD pipelines.
• Ability to explain technical risks and tradeoffs to engineers, PMs, and executives.

Responsibilities

• Define architecture principles, standards, patterns, reference implementations, and guardrails for web, mobile, APIs, microservices, and cloud-native systems.
• Lead architecture/design reviews to identify trust boundaries and security gaps.
• Lead threat modeling for new apps, features, integrations, and high-risk changes.
• Establish security requirements for authentication, authorization, encryption, secrets management, logging, privacy, and data protection.
• Embed security across the SDLC with code review, CI/CD, IaC, testing, and production monitoring.
• Guide use of security tooling (SAST, DAST, SCA, container scanning, API security testing, secret scanning, runtime protection).
• Define a vulnerability-management approach for apps and dependencies, including SLAs and remediation verification.
• Assess security risk in third-party libraries, OSS dependencies, SaaS integrations, and vendor components.
• Design IAM patterns including MFA/SSO, RBAC/ABAC, and service-to-service auth.
• Work with cloud/platform teams to secure Kubernetes, serverless, containers, CI/CD, cloud IAM, network segmentation, and secrets storage.
• Advise incident-response teams on application-layer threats and contribute to post-incident improvements.
• Maintain architecture documentation including security decision patterns, risk registers, and exception documentation.

Skills

Threat modeling

Architecture reviews

Security communication

Remediation planning

Documentation

Education

Bachelor's degree in CS, cybersecurity, engineering, or related field

Tools

SAST

DAST

Software composition analysis

Container/image scanning

API security testing

Runtime protection

Kubernetes

CI/CD pipelines

Microsoft Purview

Job description

MasterApp Labs is seeking a Senior Application Security Architect to help shape and operationalize application-security architecture principles across modern platforms. This contract role is based in Richmond, VA with hybrid expectations, including onsite presence during an initial 90-day probationary period, as security architecture reviews and SDLC security integration are built into web, mobile, API, microservices, and cloud-native systems.

Role overview

In this position, you will define application-security architecture guardrails, lead architecture security reviews and threat modeling, and partner with engineering to embed security across the development lifecycle. You will also help translate security requirements into repeatable patterns for authentication, authorization, encryption, secrets management, logging, privacy, API protection, and data protection.

Responsibilities

• Define application-security architecture principles, standards, patterns, reference implementations, and guardrails for web, mobile, APIs, microservices, and cloud-native systems.
• Conduct architecture and design reviews to identify trust boundaries, attack paths, data flows, security gaps, and compensating controls.
• Lead or facilitate threat modeling for new applications, major features, integrations, and high-risk changes.
• Establish repeatable security requirements for authentication, authorization, session management, encryption, secrets management, logging, privacy, API protection, and data protection.
• Partner with software engineers to integrate security throughout the SDLC, including code review, CI/CD pipelines, infrastructure as code, testing, release approval, and production monitoring.
• Evaluate and guide use of security tooling such as SAST, DAST, software composition analysis, container and image scanning, API security testing, secret scanning, and runtime protection.
• Define a vulnerability-management approach for applications and dependencies, including severity criteria, remediation SLAs, exception processes, and verification of fixes.
• Assess security risk in third-party libraries, open-source dependencies, SaaS integrations, and vendor components.
• Design identity and access-control patterns including least privilege, MFA/SSO integration, service-to-service authentication, RBAC/ABAC, and privileged-access controls.
• Work with cloud and platform teams to secure hosting environments such as Kubernetes, serverless, containers, CI/CD, cloud IAM, network segmentation, and secrets storage.
• Advise incident-response teams on application-layer threats, contributing to root-cause analysis and post-incident security improvements.
• Maintain architecture documentation including security decision patterns, risk registers, and exception documentation.

Requirements

• Bachelor’s degree in computer science, cybersecurity, engineering, or related field, or equivalent practical experience.
• 10+ years in software engineering, application security, security engineering, or related technical roles, including 2+ years designing security architecture for systems.
• Strong understanding of secure software-development principles and common application risks, including the OWASP Top 10, insecure authorization, injection, deserialization, and API abuse.
• Experience designing and implementing end-to-end security architectures for data-at-rest, in-transit, and in-use across Azure, SQL Server, Dynamics 365, Power Platform, and ArcGIS, using automated classification (e.g., Microsoft Purview), encryption, DLP rules, and privacy risk assessments (DPIAs).
• Experience enforcing granular data access controls including RBAC, Row-Level Security, Column-Level Encryption, and dynamic masking, plus centralized database audit logging and activity monitoring aligned with VITA SEC 530 security standards.
• Demonstrated experience with threat modeling and security architecture reviews.
• Experience securing APIs, web applications, distributed systems, cloud platforms, CI/CD pipelines, and containerized workloads.
• Working knowledge of secure coding in one or more common ecosystems such as Java, .NET, JavaScript/TypeScript, or Python.
• Experience with identity and security standards including OAuth 2.0, OpenID Connect, SAML, JWTs, authorization design, PKI/TLS, encryption, and secrets-management practices.
• Ability to clearly explain technical risks and tradeoffs to engineers, product managers, executives, and nontechnical stakeholders.
• Strong written communication skills, including creating architecture diagrams, standards, risk assessments, and actionable remediation plans.

Technologies

• OWASP Top 10
• Azure, SQL Server
• Dynamics 365, Power Platform, ArcGIS
• Microsoft Purview, DLP, DPIA, VITA SEC 530
• RBAC, Row-Level Security, Column-Level Encryption
• Java, .NET, JavaScript/TypeScript, Python
• OAuth 2.0, OpenID Connect, SAML, JWT, PKI/TLS
• SAST, DAST, software composition analysis
• Container/image scanning, API security testing, secret scanning, runtime protection
• Kubernetes, serverless

Location and work setup

• Richmond, VA (Hybrid)
• Onsite 4 days/week during an initial 90-day probationary period, with potential for reduced onsite commitment after successful probation

Interview and position type

• Contract position
• Interview mode: Both Web Cam and In Person

Compensation

• USD 65 - 70 per hour

Benefits

• 401(k) matching
• Dental insurance
• Health insurance
• Vision insurance

Preferred qualifications

• Experience in a regulated environment such as financial services, healthcare, government, or payments.
• Experience implementing DevSecOps programs and security automation at scale.
• Familiarity with privacy engineering, data classification, and compliance frameworks relevant to the organization.
• Certifications such as CISSP, CSSLP, CCSP, GIAC, cloud-security certifications, or relevant vendor credentials.
• Experience conducting or coordinating penetration testing and translating results into durable architectural improvements.