Application Security Architect

Description

You will be a senior, hands-on architect based in Portugal, reporting to the Associate Director, Security.

The team builds healthcare applications, APIs and data exchanges that handle Personal Health Information (PHI) and other sensitive client data, so protecting that data is central to the job.

You will work with application teams in Nepal and the United States. All services run on AWS or Snowflake.

You act as an embedded design and risk adviser to product, development, engineering, DevOps and infrastructure teams on new applications, new features, material changes and technology modernization.

Engineering owns each solution. Application security analysts handle routine testing, tooling, triage and remediation tracking, while you help shape the company's Secure SDLC and AIDLC.

The company provides clinical research services, commercial insights and healthcare intelligence to life sciences and healthcare organisations.

Responsibilities

• Set risk-based review criteria for new applications, features, material changes, AI features and supporting infrastructure. Carry out complex reviews and record requirements, decisions, exceptions and closure evidence.
• Spot systemic weaknesses and set priorities for modernization.
• Lead threat models for applications, APIs, admin functions, sensitive data flows, trust boundaries and AI features, using STRIDE, misuse cases and attack-path analysis. Turn the threats into design requirements.
• Write and maintain reusable security patterns, architecture decision records and guidance on identity, tenant isolation, input and file handling, cryptography, secrets, logging, PHI workflows, APIs, OAuth 2.0, OpenID Connect and service-to-service communication.
• Shape the Secure SDLC and AIDLC through architecture gates, threat-modeling criteria, secure coding and AI guardrails, testing requirements and risk-based release criteria. Cover prompt injection, data leakage, unsafe tool or output use, excessive agency, authorization bypass, and misuse of PHI, source code or credentials.
• Set validation requirements for AI-generated code and AI-enabled applications. These cover developer review, provenance and licensing, secrets and dependency scanning, SAST, SCA, DAST, API, container, infrastructure-as-code and pre-production testing. Analysts run the routine reviews.
• Guide testing, vulnerability management, supply-chain risk, penetration testing and high-risk findings, and escalate where needed. Present design options, tradeoffs and remediation plans to engineering, product, security leadership and governance groups.
• Give senior architecture review to the application and cloud security staff in Nepal on complex reviews, threat models, AI assessments, risk decisions and systemic findings, without taking over analyst work. Align the company's patterns with the enterprise security architecture requirements.

Requirements

• At least 6 years of progressive experience in application security, software engineering, product security, cloud security, security engineering or application security architecture.
• Experience reviewing new and existing architectures, threat modeling, documenting sensitive data flows and trust boundaries, and turning threats into practical requirements. Strong grasp of application and API security, multi-tenant SaaS, identity, cryptography, secrets, logging, supply-chain risk and PHI processing.
• Experience shaping Secure SDLC and AIDLC practices, defining risk-based review and release criteria, and building security into CI/CD. You know SAST, SCA, DAST, API, secrets, container, infrastructure-as-code and penetration testing. You have assessed generated code, AI assistants, agents, LLM integrations and handling of sensitive data.
• Familiarity with AWS architecture for application-facing systems, plus standards such as OWASP ASVS, OWASP Top 10, OWASP API Security Top 10, OWASP SAMM, OWASP LLM guidance, NIST Secure Software Development Framework, MITRE CWE, HIPAA, HITRUST, SOC 2, CIS and NIST requirements.
• Strong analytical and communication skills, and fluent English. A bachelor's degree in a related field or equivalent practical experience.
• Preferred: 6 to 8 years of directly relevant experience.
• Preferred: experience in healthcare SaaS, PHI exchange, analytics, managed file transfer or sFTP, and multi-tenant platforms.
• Preferred: hands-on development or DevOps experience, and experience bringing an acquired business into enterprise AppSec practices.
• Preferred: CSSLP, CISSP, CCSP, GIAC Web Application Defender or a relevant AWS certification.

Conditions

Based in Portugal and reporting to the Associate Director, Security.

Most of the work happens during U.S. business hours, with teams in the United States, Nepal, Portugal and other company locations.

The company is committed to equal opportunity and to equal treatment of women and men.