App Security Architect

Location: Richmond, VA

Work Arrangement: Hybrid/Remote (Occasional onsite presence required)

Employment Type: Contract-to-Hire (6 months)

Interview Mode: Web Cam Only

Shift: EST

Secure SDLC: Provide expert guidance on secure design, coding standards, and vulnerability remediation across Agile/Scrum workflows.

Risk Assessment: Evaluate software architecture, perform source code reviews (C#, Java, JavaScript, SQL), and identify risks related to APIs and microservices.

Security Testing: Utilize SAST, DAST, and IAST tools (Veracode, Accunetix, etc.) to detect and mitigate vulnerabilities, including the OWASP Top 10.

Cloud & Infrastructure: Implement AWS cloud security controls and leverage Terraform for automated provisioning and multi-account landing zones.

Monitoring & Compliance: Interpret SIEM (Splunk) findings, maintain System Security Plans (SSPs), and ensure alignment with NIST 800-53 and IRS Pub 1075.

Mentorship: Deliver security training to development and operations teams to promote a culture of DevSecOps.

Application Security: 5+ years of dedicated experience in the field.

Cloud & Networking: 2+ years of experience with AWS Security Groups, firewalls, and hybrid connectivity (Direct Connect/VPN).

Tool Proficiency: 4+ years of experience with SIEM (Splunk), EDR, IDS/IPS, and vulnerability scanners (Rapid7/Tenable).

Infrastructure as Code: 2+ years of advanced proficiency in Terraform.

Mandatory Certification: You MUST hold at least one of the following:

• CompTIA Security+, ISC2 CC, OSCP, CCSP, or CSSLP (Proof of certification required at submission).

CI/CD: 5+ years with GitLab CI/CD, Jenkins, or AWS CodePipeline.

AWS Expertise: AWS Solutions Architect or AWS Security Specialty certifications.

Advanced Security: CEH, PenTest+, or GIAC certifications.

OS Hardening: Experience with baseline hardening for Linux and Windows environments.