Application Security Architect (AI)

Quick Facts

Role focus: Application Security Architecture with AI-assisted security workflows (foundational level).

Description

Design and implement security architectures and controls for enterprise applications, APIs, microservices, and cloud-native applications. Lead application security reviews, threat modeling, secure design assessments, and risk analysis while building secure reference architectures and integrating security into SSDLC/DevSecOps. Improve security tooling and automation in CI/CD and use AI-assisted tools to strengthen vulnerability assessment, remediation recommendations, and security documentation with validation and human oversight.

Responsibilities

• Design and implement security architectures and controls for enterprise applications, APIs, microservices, and cloud-native systems; gather business, technical, and compliance requirements for secure solutions across implementations, migrations, and security improvements.
• Define and improve application security capabilities: authentication, authorization, API security, encryption, secrets management, and secure configuration.
• Conduct security architecture reviews, threat modeling, secure design assessments, and application security risk analysis.
• Develop application security reference architectures, security standards, secure design patterns, and secure development guidelines.
• Support Secure Software Development Lifecycle (SSDLC), secure-by-design principles, and DevSecOps integration.
• Evaluate and improve application security technologies and processes (SAST, DAST, SCA, secrets scanning, vulnerability management); review vulnerabilities and recommend remediation strategies.
• Collaborate with development, DevOps, cloud, infrastructure, IAM, security operations, and compliance teams to integrate security into application design and development.
• Support security automation and application security tooling integration into CI/CD pipelines and development workflows.
• Use AI-assisted tools and workflows for threat modeling and security architecture analysis, vulnerability assessment, remediation recommendations, and secure code review support; also assist with requirements and compliance analysis and security testing.
• Identify opportunities for AI-assisted application security automation while ensuring validation, data protection, and human oversight; communicate risks, architectural decisions, and remediation plans to stakeholders and security leadership.

Requirements

• Bachelor's degree in Computer Science, Cybersecurity, Engineering, or equivalent practical experience.
• Five-plus years of information security experience focused on application security architecture/design or application security engineering.
• Hands-on application security expertise: vulnerability identification, security risk assessment, and recommending technical security controls; knowledge of OWASP Top 10 and secure coding practices.
• Experience performing application security architecture reviews, threat modeling, secure design assessments, or security risk analysis; experience with SAST, DAST, SCA, and secrets scanning (or similar).
• Working knowledge of Secure SDLC, DevSecOps, CI/CD security, and secure-by-design; ability to work with at least one programming language (Python, Java, C#, JavaScript/TypeScript, or Go) for code review and risk assessment.
• Understanding of adjacent domains: cloud security, IAM, network security, data protection, and security operations; familiarity with Zero Trust and frameworks such as NIST, ISO 27001, or OWASP guidelines.
• Experience with security automation/scripting and intermediate AI-assisted tooling and automation (AI for vulnerability analysis/threat modeling, structured prompting, generating/validating scripts/queries, AI-assisted recommendations/documentation, and basic workflow integration).
• Safe AI usage knowledge (data protection, access control, validation of AI-generated outputs) and willingness to develop AI automation skills further.
• Strong communication and collaboration skills; hands-on technical proficiency.

Nice to Have

• Experience with application security platforms/tools such as Snyk, Checkmarx, Veracode, SonarQube, Semgrep, GitHub Advanced Security, Burp Suite, OWASP ZAP.
• Threat modeling methodologies/tools: STRIDE, OWASP Threat Dragon, Microsoft Threat Modeling Tool; DevSecOps/CI/CD security automation.
• Software supply chain security (SBOM, dependency and third-party component security) and API security patterns (OAuth 2.0, OpenID Connect), secrets management.
• Integration of findings with SIEM/SOAR and ticketing/vulnerability management; AI automation tools like Copilot Studio, Azure OpenAI, Amazon Bedrock, LangChain, Power Automate (or similar).
• AI application security risk knowledge (prompt injection, data leakage, insecure output handling, excessive agent permissions) and familiarity with OWASP Top 10 for LLM Applications.
• Security certifications (CSSLP, CISSP, CISM, CCSP, GWAPT, GWEB, OSCP, OSWE) and AI certifications (AI-900, AWS Certified AI Practitioner).

Benefits

• Hybrid-by-design model with the ability to work remotely within Poland.
• Opportunity to work abroad for up to 60 days annually and possible business-driven relocation.
• Career development programs, mentoring, soft skills and well-being programs.
• Certification support (Anthropic, Gemini, GCP, Azure, AWS) and English classes.
• Stable pay; Employee Stock Purchase Plan with a 15% discount.
• Benefits package: health insurance, multisport, shopping vouchers; referral bonuses up to $2,000.
• Office amenities and social/well-being events.
• Note: Benefits are for employees only; contractor work may be possible via individually agreed B2B terms.