Saarthee - Application Security Architect - Threat Modeling (8-14 yrs)

Job Description :

Position Summary :

We are looking for a skilled Application Security Architect to strengthen and advance the security of our applications and products.

This role focuses on designing and implementing robust security solutions for modern application architectures, including web applications, APIs, microservices, and cloud-native platforms.

The ideal candidate will lead efforts in threat modeling, secure API and microservice communication, and embedding security practices throughout the Software Development Lifecycle (SDLC), ensuring end-to-end protection across all stages of development.

Your Role Responsibilities and Duties :

- Design secure API architectures using OAuth 2.0, JWT, encryption, and API gateways.

- Apply OWASP best practices and secure API integrations for REST, GraphQL, Webhooks, etc.

- Secure containerized microservices (Docker, Kubernetes) with Zero Trust principles, mTLS, and secret management.

- Perform threat modeling (e., STRIDE) and risk assessments using tools like OWASP Threat Dragon.

- Identify vulnerabilities and implement security-by-design principles.

- Enforce secure coding standards (OWASP Top 10) and integrate security into CI/CD pipelines (SAST, DAST, SCA).

- Champion security in design, development, and deployment stages.

- Design security for cloud-native applications (AWS, Azure, GCP) using IaC and secure configurations.

- Address cloud threat management, compliance, and container security.

- Implement SSO, OAuth, RBAC, and MFA for sensitive systems and APIs.

- Conduct security assessments on external libraries and enforce SBOM verification and patching.

Required Skills and Qualifications :

- Post graduate or Graduate in computer science, Information Security, or a related field.

- A minimum of 10+ years of experience in application security architecture and secure software development.

- Knowledge of security standards such as OWASP Top 10 (Web, API, CI/CD), NIST CSF 2.0, NIST (SP800-218, SP800-37, SP800-53r5, SP800-161), ISO, SOC 2, GDPR, and PCI DSS, CIS Controls.

- Relevant cybersecurity certifications such as CSSLP, CISSP, CCSP, or AWS Certified Security - Specialty and other similar cloud security certifications are a plus.

- Strong experience in conducting, participating in, or practicing Threat Modelling is preferred.

- Knowledge of Security and Privacy Design Principles is expected.

- Expertise in securing and designing Enterprise REST APIs and Native Cloud applications and must have integrated OAuth 2. 0 in these designs.

- Experience with any of the following standards or frameworks will be checked.

- NIST SP800-218 (Secure Software Development Framework)

- CIS Controls Framework - OWASP SAMM or OWASP ASVS

- Other NIST standards such as SP800-37, SP800-39, SP800-30, or NIST Cybersecurity Framework (CSF 2.0)

- If you have worked with SBOMs (Software Bill of Materials) to identify and mitigate supply chain risks, the role will be highly relevant for you.

What we Offer :

- Bootstrapped and financially stable with high pre-money evaluation.

- Above industry renumerations.

- Additional compensation tied to Renewal and Pilot Project Execution.

- Additional lucrative business development compensation.

- Firm building opportunities that offer stage for holistic professional development, growth, and branding.

- Empathetic, excellence and result driven organization.

- Believes in mentoring and growing a team with constant emphasis on learning