Application Security Architect

We are seeking an Application Security Architect to join our Security team and lead the design and implementation of secure software solutions across the organization. The ideal candidate is proactive, technically adept, and deeply knowledgeable in secure software development practices. You will collaborate closely with development teams to embed security into the software lifecycle from the ground up, ensuring robust protection of sensitive data and systems.

This role involves conducting security assessments, defining application security requirements, and promoting secure coding standards. You will also stay ahead of emerging threats and vulnerabilities, applying this intelligence to continuously strengthen the organization’s application security posture. Your expertise will be critical in safeguarding the confidentiality, integrity, and availability of our applications.

Key duties and responsibilities

As an Application Security Architect, you will be responsible for designing and implementing secure software solutions across SCOR’s IT landscape. You will collaborate with development and IT teams to embed security into the software development lifecycle (SDLC), define and enforce secure coding practices, and ensure compliance with SCOR’s internal control and security standards. You will also monitor emerging threats and vulnerabilities, and proactively adapt security measures to maintain the confidentiality, integrity, and availability of SCOR’s business applications.

Key Responsibilities:

•    Security Architecture Standards: Develop and maintain security architecture standards for cloud infrastructures, APIs, and applications, and promote their adoption across IT functional teams 
•    Secure SDLC Integration: Participate in the review and definition of the software development and SaaS integration lifecycle, aligning with SCOR’s internal control and OWASP-based best practices (e.g., SAMM, ASVS, Top 10 proactive controls, STG, Cheat Sheet Series) 
•    Operational Security Practices: Define and maintain standard operational security practices across application environments.
•    Network Security Advocacy: Promote and drive adoption of network security practices throughout the enterprise.
•    Security Metrics and Dashboards: Develop and maintain dashboards to track program maturity, incidents, and operational effectiveness.
•    Security Configuration Management: Define and enforce standard security configurations for technical solutions to ensure availability, integrity, data protection, and privacy.
•    Security Assessment and Enhancement: Review current security measures on business applications and recommend enhancements based on evolving standards.
•    Audit Remediation Support: Assist IT teams in implementing remediation plans for security findings identified during audits.

Key Duties:

•    Design and enforce secure architecture standards for cloud and application environments.
•    Integrate security into the software development lifecycle using OWASP-aligned frameworks.
•    Maintain and promote operational and network security practices.
•    Monitor and report on application security posture using metrics and dashboards.
•    Review and enhance security configurations and controls for business applications.
•    Support remediation efforts for audit findings and ensure compliance with SCOR’s security policies.
 

Required experience & competencies

Must adhere to our Key Security Principles and Team Values:

• Security Principles: Defend the business, support the business, and promote responsible information security behavior.
• Team Values: Professionalism, Ethics, Transparency, and Team Spirit.

Hard skills

• Minimum 5-10 years of overall IT experience, with at least 3 years in a dedicated Application Security, Security Architecture, or Secure Software Engineering role in complex enterprise environments.

• Proven experience designing and enforcing application security architectures for business‑critical and regulated systems, covering on‑premise, cloud, and hybrid environments.

• Hands-on experience embedding security into the SDLC across multiple delivery models (Agile, DevSecOps, SaaS integration), including security gates, threat modeling, and architecture reviews.

• Demonstrated experience working with development teams as a security authority and trusted advisor, not only as a reviewer or auditor.

• Prior exposure to audit, regulatory, or internal control environments, with a track record of supporting remediation and demonstrating security-by-design.

• Strong hands-on experience securing cloud-based applications

• Experience integrating security into CI/CD pipelines, including: SAST, DAST, SCA, and dependency scanning
• Solid understanding of modern authentication and identity federation mechanisms (OIDC, OAuth2, SAML), and their application in enterprise and SaaS contexts.
• Good understanding of networking fundamentals and security controls (protocols, proxies, firewalls, WAFs, segmentation).
• Strong knowledge of enterprise IAM and identity platforms (hybrid IdP, IAM, MDM), and their impact on application security design.
• Scripting and automation capability (PowerShell and/or equivalent) to support security assessments, controls, or integrations.
• Working knowledge of Windows and cross-platform environments, including security services and policy enforcement.
• Demonstrated ability to translate security principles into enforceable requirements aligned with internal control frameworks and policies.

Soft skills

• Strong analytical and problem-solving skills.

• Effective communication and collaboration abilities.

• Ability to work independently and in cross-functional teams.

• Attention to detail and a proactive mindset.

Required Education 

• Master’s degree in Computer Science, Cybersecurity, or a closely related field (mandatory).

• Relevant security certifications strongly preferred, such as:

  • CSSLP

  • CISSP (or ISSAP)

  • CCSP

  • GIAC Application Security certifications

  • Cloud security certifications (Azure / AWS / GCP)