Senior Application Security Architect (Hybrid – Contract)

MasterApp Labs LLC; Richmond (VA); Hybrid; USD 150,000 - 210,000; Full time

Job summary

MasterApp Labs LLC is seeking a Senior Application Security Architect in Richmond, VA. This contract role is hybrid with four onsite days per week during a 90-day probationary period, with potential for reduced onsite thereafter.

You will define architecture principles, lead threat modeling, and integrate security across the SDLC for web, mobile, API, and cloud-native systems. Expect collaboration with engineers and incident-response teams.

Qualifications

• 10+ years in software engineering, application security, security engineering, or related technical roles, including 2+ years designing security architecture for systems.
• Bachelor’s degree in computer science, cybersecurity, engineering, or related field or equivalent practical experience.
• Strong understanding of secure software-development principles and OWASP Top 10, insecure authorization, injection, deserialization, and API abuse.
• Design and implement end-to-end security architectures for data-at-rest, in-transit, and in-use across multiple platforms and tools.
• Enforce granular data access controls (RBAC, Row-Level Security, encryption) and centralized audit logging.
• Demonstrated experience with threat modeling and security architecture reviews.
• Experience securing APIs, web apps, distributed systems, CI/CD pipelines, and containerized workloads.
• Working knowledge of secure coding in Java, .NET, JavaScript/TypeScript, Python.
• Experience with OAuth2, OpenID Connect, SAML, JWTs, PKI/TLS, encryption, and secrets-management.
• Ability to explain risks and tradeoffs to engineers, PMs, executives.

Responsibilities

• Define application-security architecture principles, standards, patterns, and guardrails for web, mobile, API, microservice, and cloud-native systems.
• Perform architecture and design reviews; identify trust boundaries, attack paths, data flows, security gaps, and compensating controls.
• Lead or facilitate threat modeling for new applications and major features.
• Establish repeatable security requirements for authentication, authorization, session management, encryption, and data protection.
• Partner with engineers to integrate security throughout the SDLC, including CI/CD and IaC.
• Evaluate and guide use of security tools (SAST/DAST, SCA, container scanning, API testing, secret scanning, runtime protection).
• Define a vulnerability-management approach with SLAs and remediation verification.
• Assess third-party libraries, open-source dependencies, and vendor components for security risk.
• Design identity/access-control patterns (RBAC, MFA/SSO, privileges).
• Secure hosting environments with Kubernetes, serverless, containers, and cloud IAM.
• Advise incident-response teams on application-layer threats and root-cause analysis.
• Maintain architecture docs, risk registers, and decision records.

Skills

Software engineering

Application security

Security engineering

Threat modeling

Security architecture

Cloud security

CI/CD security

Container security

API security

Secure coding

Education

Bachelor’s degree

Tools

SAST

DAST

Software composition analysis

Container/image scanning

API security testing

Secret scanning

Runtime protection

Job description

MasterApp Labs LLC is seeking a Senior Application Security Architect in Richmond, VA. This contract role is hybrid with four onsite days per week during a 90-day probationary period, with potential for reduced onsite thereafter.

You will define architecture principles, lead threat modeling, and integrate security across the SDLC for web, mobile, API, and cloud-native systems. Expect collaboration with engineers and incident-response teams.