Senior Application Security Architect

MasterApp Labs LLC; Richmond (VA); Hybrid; USD 150,000 - 210,000; Full time

Job summary

MasterApp Labs LLC is seeking a Senior Application Security Architect in Richmond, VA. This contract role is hybrid with four onsite days per week during a 90-day probationary period, with potential for reduced onsite thereafter.

You will define architecture principles, lead threat modeling, and integrate security across the SDLC for web, mobile, API, and cloud-native systems. Expect collaboration with engineers and incident-response teams.

Qualifications

• 10+ years in software engineering, application security, security engineering, or related technical roles, including 2+ years designing security architecture for systems.
• Bachelor’s degree in computer science, cybersecurity, engineering, or related field or equivalent practical experience.
• Strong understanding of secure software-development principles and OWASP Top 10, insecure authorization, injection, deserialization, and API abuse.
• Design and implement end-to-end security architectures for data-at-rest, in-transit, and in-use across multiple platforms and tools.
• Enforce granular data access controls (RBAC, Row-Level Security, encryption) and centralized audit logging.
• Demonstrated experience with threat modeling and security architecture reviews.
• Experience securing APIs, web apps, distributed systems, CI/CD pipelines, and containerized workloads.
• Working knowledge of secure coding in Java, .NET, JavaScript/TypeScript, Python.
• Experience with OAuth2, OpenID Connect, SAML, JWTs, PKI/TLS, encryption, and secrets-management.
• Ability to explain risks and tradeoffs to engineers, PMs, executives.

Responsibilities

• Define application-security architecture principles, standards, patterns, and guardrails for web, mobile, API, microservice, and cloud-native systems.
• Perform architecture and design reviews; identify trust boundaries, attack paths, data flows, security gaps, and compensating controls.
• Lead or facilitate threat modeling for new applications and major features.
• Establish repeatable security requirements for authentication, authorization, session management, encryption, and data protection.
• Partner with engineers to integrate security throughout the SDLC, including CI/CD and IaC.
• Evaluate and guide use of security tools (SAST/DAST, SCA, container scanning, API testing, secret scanning, runtime protection).
• Define a vulnerability-management approach with SLAs and remediation verification.
• Assess third-party libraries, open-source dependencies, and vendor components for security risk.
• Design identity/access-control patterns (RBAC, MFA/SSO, privileges).
• Secure hosting environments with Kubernetes, serverless, containers, and cloud IAM.
• Advise incident-response teams on application-layer threats and root-cause analysis.
• Maintain architecture docs, risk registers, and decision records.

Skills

Software engineering

Application security

Security engineering

Threat modeling

Security architecture

Cloud security

CI/CD security

Container security

API security

Secure coding

Education

Bachelor’s degree

Tools

SAST

DAST

Software composition analysis

Container/image scanning

API security testing

Secret scanning

Runtime protection

Job description

Title: Senior Application Security Architect

Location: Richmond, VA, (Hybrid)-Onsite 4 days/week during an initial 90-day probationary period; there is a possibility of reduced onsite commitment after successful probation

Position Type: Contract

Interview Mode: Both Web Cam and In Person Interview

Core Responsibilities

• Define application-security architecture principles, standards, patterns, reference implementations, and guardrails for web, mobile, API, microservice, and cloud-native systems.
• Perform architecture and design reviews, identify trust boundaries, attack paths, data flows, security gaps, and compensating controls.
• Lead or facilitate threat modeling for new applications, major features, integrations, and high-risk changes.
• Establish repeatable security requirements for authentication, authorization, session management, encryption, secrets management, logging, privacy, API protection, and data protection.
• Partner with software engineers to integrate security throughout the SDLC, including code review, CI/CD pipelines, infrastructure as code, testing, release approval, and production monitoring.
• Evaluate and guide use of security tools such as SAST, DAST, software composition analysis, container/image scanning, API security testing, secret scanning, and runtime protection.
• Define a vulnerability-management approach for applications and dependencies, including severity criteria, remediation SLAs, exception processes, and verification of fixes.
• Assess third-party libraries, open-source dependencies, SaaS integrations, and vendor-provided components for security risk.
• Design identity and access-control patterns, including least privilege, MFA/SSO integration, service-to-service authentication, RBAC/ABAC, and privileged-access controls.
• Work with cloud and platform teams to secure application hosting environments, including Kubernetes, serverless, containers, CI/CD, cloud IAM, network segmentation, and secrets storage.
• Advise incident-response teams on application-layer threats and contribute to root-cause analysis and security improvements after incidents.
• Maintain architecture documentation, security decision patterns, risk registers, and exception documentation.

Required Qualifications

• Bachelor’s degree in computer science, cybersecurity, engineering, or a related field or equivalent practical experience.
• 10+ years in software engineering, application security, security engineering, or related technical roles, including 2+ years designing security architecture for systems.
• Strong understanding of secure software-development principles and common application risks, including the OWASP Top 10, insecure authorization, injection, deserialization and API abuse.
• Design and implement end-to-end security architectures for data-at-rest, in-transit, and in-use across Azure, SQL Server, Dynamics 365, Power Platform, and ArcGIS platforms, utilizing automated classification (e.g., Microsoft Purview), robust encryption, DLP rules, and privacy risk assessments (DPIAs) to protect sensitive state transportation and infrastructure assets.
• Enforce granular data access controls (including RBAC, Row-Level Security, Column-Level Encryption, and dynamic masking) and establish centralized database audit logging and activity monitoring pipelines to ensure strict alignment with VITA SEC 530 security standards.
• Demonstrated experience with threat modeling and security architecture reviews.
• Experience securing APIs, web applications, distributed systems, cloud platforms, CI/CD pipelines, and containerized workloads.
• Working knowledge of secure coding in one or more common ecosystems, such as Java, .NET, JavaScript/TypeScript, Python platforms.
• Experience with identity, OAuth 2.0, OpenID Connect, SAML, JWTs, authorization design, PKI/TLS, encryption, and secrets-management practices.
• Ability to explain technical risks and tradeoffs clearly to engineers, product managers, executives, and nontechnical stakeholders.
• Strong written communication skills, including the ability to create architecture diagrams, standards, risk assessments, and actionable remediation plans.

Preferred Qualifications

• Experience in a regulated environment such as financial services, healthcare, government, or payments.
• Experience implementing DevSecOps programs and security automation at scale.
• Familiarity with privacy engineering, data classification, and compliance frameworks relevant to the organization.
• Certifications such as CISSP, CSSLP, CCSP, GIAC, cloud-security certifications, or relevant vendor credentials.
• Experience conducting or coordinating penetration testing and translating results into durable architectural improvements.

Required/Desired Skills

Skill Required /Desired Amount Actual Years of Experience Software engineering, application security, security engineering, or related technical roles Required 10 Experience in designing and implementing security architecture for IT systems Required 6 Secure software-development principles and common risks, including the OWASP Top 10, insecure authorization, injection, deserialization and API abuse Required 6 Design and implement end-to-end security architectures for data-at-rest, in-transit, and in-use for full MS stack (Azure, O365, Power Platform, D365) Required 6 Demonstrated experience with threat modeling and security architecture reviews Required 6 Experience securing APIs, web applications, distributed systems, cloud platforms, CI/CD pipelines, and containerized workloads Required 6 Experience with identity, OAuth 2.0, OpenID Connect, SAML, JWTs, authorization design, PKI/TLS, encryption, and secrets-management practices Required 6 Strong written communication skills, including ability to create architecture diagrams, standards, risk assessments, and actionable remediation plans Required 10 Experience in a regulated environment such as financial services, healthcare, government, or payments Highly desired 6 Experience conducting or coordinating penetration testing and translating results into durable architectural improvements Highly desired 6 Experience implementing DevSecOps programs and security automation at scale Highly desired 4 Familiarity with privacy engineering, data classification, and compliance frameworks Highly desired 4 Experience with security architectures in Esri's ArcGIS platform Highly desired 2