Application Security Architect

About the role

The Application Security Architect protects personal health information (PHI) and other sensitive client data for Cedar Gate, a healthcare application team based in Nepal and the United States. This senior, hands-on role is an embedded design and risk advisor for product, development, engineering, DevOps and infrastructure teams, all hosted on AWS or Snowflake. It reports to the Cedar Gate Associate Director, Security, and influences the Secure SDLC and AIDLC.

Key responsibilities

• Set risk-based review criteria for new applications, functionality, material changes, AI features and infrastructure, and lead complex reviews and documentation
• Lead threat modeling for applications, APIs, data flows and AI features using STRIDE, misuse cases and attack-path analysis
• Maintain reusable security patterns, architecture decision records and guidance on identity, cryptography, secrets, logging, OAuth 2.0, OpenID Connect and PHI workflows
• Influence secure SDLC and AIDLC through architecture gates, secure coding and AI guardrails, and risk-based release criteria
• Define validation requirements for AI-generated code, including developer review, provenance, licensing, scanning and testing
• Escalate testing, vulnerability management, supply-chain risk and penetration testing issues, and present design recommendations to engineering, product and security leadership
• Review complex applications and threat models for Nepal application and cloud security personnel, aligning patterns with IQVIA security architecture requirements

Required profile

• 6+ years of progressive experience in application security, software engineering, product security, cloud security or security engineering; 6-8 years directly relevant preferred
• Experience reviewing architectures, threat modeling and embedding security in CI/CD
• Fluent English; able to work mainly during U.S. business hours with teams in the U.S., Nepal and Portugal
• Bachelor's degree in a related field or equivalent practical experience

Required skills

• Application and API security, multi-tenant SaaS, identity, cryptography, secrets, logging, supply-chain risk and PHI processing
• SAST, SCA, DAST, container and infrastructure-as-code security, penetration testing
• AWS architecture and standards such as OWASP ASVS, OWASP Top 10, OWASP API Security Top 10, OWASP SAMM, NIST SSDF, MITRE CWE, HIPAA, HITRUST, SOC 2, CIS and NIST