Senior Application Security Architect - SSDLC & Cloud

V Group Inc.; Richmond (VA); On-site; USD 140,000 - 180,000; Part time

Job summary

VDOT Application Security Architect role requires leading security for enterprise IT initiatives across web, cloud-native and GIS systems. You will define SSDLC-embedded security, oversee data protection, and ensure compliance with state standards.

Responsibilities include threat modeling, security-pattern definition, and collaboration with developers to weave security into CI/CD, along with governance and risk documentation.

Qualifications

• Bachelor’s degree in computer science, cybersecurity, engineering, or a related field.

Responsibilities

• Define application-security architecture principles, standards, patterns, reference implementations, and guardrails for web, mobile, API, microservice, and cloud-native systems.
• Perform architecture and design reviews, identify trust boundaries, attack paths, data flows, security gaps, and compensating controls.
• Lead or facilitate threat modeling for new applications, major features, integrations, and high-risk changes.
• Establish repeatable security requirements for authentication, authorization, session management, encryption, secrets management, logging, privacy, API protection, and data protection.
• Partner with software engineers to integrate security throughout the SDLC, including code review, CI/CD pipelines, infrastructure as code, testing, release approval, and production monitoring.
• Evaluate and guide use of security tools such as SAST, DAST, software composition analysis, container/image scanning, API security testing, secret scanning, and runtime protection.
• Define a vulnerability-management approach for applications and dependencies, including severity criteria, remediation SLAs, exception processes, and verification of fixes.
• Assess third-party libraries, open-source dependencies, SaaS integrations, and vendor-provided components for security risk.
• Design identity and access-control patterns, including least privilege, MFA/SSO integration, service-to-service authentication, RBAC/ABAC, and privileged-access controls.
• Work with cloud and platform teams to secure hosting environments, including Kubernetes, serverless, containers, CI/CD, cloud IAM, network segmentation, and secrets storage.
• Advise incident-response teams on application-layer threats and contribute to root-cause analysis and security improvements after incidents.
• Maintain architecture documentation, security decision patterns, risk registers, and exception documentation.

Skills

Security architecture

Threat modeling

OWASP Top 10

Identity & access

Cloud security (Azure)

Data protection & encryption

CI/CD security

SAST/DAST tooling

Kubernetes security

Education

Bachelor’s degree in computer science/cybersecurity/engineering

Tools

SAST

DAST

SCA

Container/image scanning

API security testing

Job description

VDOT Application Security Architect role requires leading security for enterprise IT initiatives across web, cloud-native and GIS systems. You will define SSDLC-embedded security, oversee data protection, and ensure compliance with state standards.

Responsibilities include threat modeling, security-pattern definition, and collaboration with developers to weave security into CI/CD, along with governance and risk documentation.