Security Architect

Hi,

Role : Security Architect

Work location : Sunnyvale,CA(On-site Mandatory)

Duration : On-Going Project

Key Responsibilities

Security architecture and design review

• Review the security architecture of enterprise applications and services: trust boundaries, identity and tenancy models, authorisation models, and sensitive-data flows
• Conduct threat modelling (STRIDE or equivalent) with engineering teams and derive prioritised, testable review plans from the model
• Identify design-level weaknesses that automated tooling does not surface — perimeter and gateway bypass, internal-trust assumptions that fail under external exposure, loss of end-user identity across service-to-service hops, and client-side-enforced tenant isolation
• Review authentication and authorisation architecture: OAuth2/OIDC usage, token validation completeness, service-to-service authentication, and object- and function-level authorisation across roles and tenants
• Review data-protection design: encryption in transit and at rest, key management, secrets handling, and logging hygiene for sensitive data
• Review platform architecture: container and Kubernetes security posture, infrastructure-as-code, and cloud IAM least privilege

Target-state design and patterns

• Specify target-state designs for architectural weaknesses, not problem statements alone
• Develop and publish reusable secure-design patterns and reference architectures for adoption across engineering teams
• Act as the design authority engineering teams consult before implementing security remediation
• Feed systemic recommendations into SDLC and CI/CD controls to prevent recurrence

Assurance and standards

• Define security review standards, assessment criteria and scoring or rating models, and defend them under challenge
• Assess applications against those standards and produce the resulting assurance findings and ratings
• Provide technical direction and quality assurance for a small security review team, including offshore members
• Mentor engineers in architecture-level security review

Stakeholder engagement

• Partner with central information security functions on assessment scope, coverage and findings
• Advise application owners and engineering leads on remediation design and prioritisation
• Escalate risks and blockers clearly and early

---

Required Skills and Experience

• 10+ years in application or product security, including time in a named security architect or design authority role on enterprise systems
• Demonstrable track record of identifying design-level security weaknesses and specifying target-state designs that were adopted
• Experience authoring reference architectures or secure-design patterns used by multiple engineering teams
• Experience on, or running, an architecture or design review board or equivalent design gate
• Threat modelling at architecture level, including facilitating sessions with teams new to the practice
• Java and Spring Boot secure design and code review, including Spring Security and API gateway layers; awareness of reactive/non-blocking codebases
• Identity and access architecture — OAuth2/OIDC, JWT validation, federated enterprise identity providers, service-to-service authentication (HMAC-signed requests, app-to-app token exchange), session and token lifecycle
• Multi-tenant authorisation architecture — broken object- and function-level authorisation, tenant isolation design and verification
• Cloud and container security architecture — Kubernetes and Helm, container hardening, infrastructure-as-code review, cloud IAM across at least two major providers
• Working knowledge of OWASP ASVS, OWASP Top 10, OWASP API Security Top 10, and **CVSS v4.0
• Experience handling confidential or regulated data under a formal classification scheme
• Ability to build the security model of a proprietary or undocumented internal framework from its source code
• Strong written communication — designs, findings and rationale must be actionable by engineers
• Ability to influence without direct authority, and to work credibly with both central security functions and delivery teams

---

Preferred

• AI / LLM application security architecture — retrieval-augmented generation design, tenant isolation on retrieval, prompt and template provenance, treating model output as untrusted, agent and tool credential scope, Model Context Protocol (MCP) exposure
• Hands-on security testing or penetration testing background, sufficient to validate and demonstrate a finding
• API security architecture and authorisation-matrix testing
• Software supply chain, SBOM and dependency risk management
• Experience establishing a security assurance programme where no formal process previously existed
• Familiarity with enterprise CI/CD security gates (SAST, SCA, secrets scanning)

---

Certifications

Demonstrable architectural depth is weighted above certification. One or more of the following is expected:

• CISSP, **CSSLP, **CISSP-ISSAP, or **SABSA
• Valuable additions: CCSP, **CKS, **OSCP, **GWAPT, or a recognised threat-modelling credential

---

Education

Bachelor's degree in Computer Science, Information Security, Engineering or a related field — or equivalent professional experience.

Pay: $65.00 - $70.00 per hour

Expected hours: 40.0 per week

Work Location: In person