Skip To Main Content
epam-logo-black.svgepam-logo-black.svg
backBack to Search

Application Security Architect + AI

Remote in Türkiye
Security.Engineering
Looking for something else?

Find a vacancy that works for you. Send us your CV to receive a personalized offer.

Find me a job

We are seeking an experienced Application Security Architect with a passion for AI-driven security innovation to join our team.

In this role, you will design and implement robust security architectures for enterprise applications while leveraging AI-assisted tools to enhance application security practices. You will collaborate across engineering, DevOps, cloud and compliance teams to embed security into every stage of the software development lifecycle.

Responsibilities
  • Design and implement security architectures and controls for enterprise applications, APIs, microservices and cloud-native applications
  • Gather business, technical and compliance requirements to design secure application solutions for new implementations, migrations and security improvements
  • Define and improve application security capabilities, including authentication, authorization, API security, encryption, secrets management and secure configuration
  • Conduct security architecture reviews, threat modeling, secure design assessments and application security risk analysis
  • Develop application security reference architectures, security standards, secure design patterns and secure development guidelines
  • Support Secure Software Development Lifecycle (SSDLC), secure-by-design principles and DevSecOps integration across engineering teams
  • Evaluate and improve application security technologies and processes, including SAST, DAST, SCA, secrets scanning and vulnerability management
  • Review application security vulnerabilities, identify architectural weaknesses and recommend appropriate remediation strategies
  • Collaborate with development, DevOps, cloud, infrastructure, IAM, security operations and compliance teams to integrate security into application design and development
  • Leverage AI-assisted tools and workflows to improve application security activities such as threat modeling, vulnerability assessment, secure code review, compliance analysis, security scripting and workflow automation
  • Identify opportunities for AI-assisted application security automation while ensuring appropriate validation, data protection and human oversight
  • Communicate application security risks, architectural decisions and remediation plans to stakeholders and security leadership
Requirements
  • Bachelor's degree in Computer Science, Cybersecurity, Engineering, or equivalent practical experience
  • 5+ years of information security experience, with a focus on application security architecture, secure application design or application security engineering
  • Background in delivering or significantly contributing to application security architecture, secure development, DevSecOps integration or application security improvement projects
  • Expertise in application security, including identifying vulnerabilities, assessing security risks and recommending technical security controls
  • Understanding of application security principles, OWASP Top 10, secure coding practices, API security, authentication, authorization and common vulnerability mitigation techniques
  • Proficiency in application security architecture reviews, threat modeling, secure design assessments or security risk analysis
  • Familiarity with application security tools and technologies such as SAST, DAST, SCA or secrets scanning solutions
  • Knowledge of Secure SDLC, DevSecOps, CI/CD security and secure-by-design principles
  • Working knowledge of at least one programming language such as Python, Java or C# (or JavaScript/TypeScript, Go), sufficient to review code and assess application security risks
  • Competency in related security domains, including cloud security, IAM, network security, data protection and security operations
  • Understanding of security architecture frameworks such as Zero Trust, NIST, ISO 27001 or OWASP guidelines
  • Skills in application security automation, scripting and security tooling integration
  • Intermediate practical experience with AI-assisted tools and automation, including using AI for vulnerability analysis and threat modeling, applying structured prompting, generating and validating scripts or secure code recommendations, simplifying repetitive workflows and configuring AI-assisted integrations
  • Understanding of safe AI usage, including data protection, access control and validation of AI-generated outputs, with willingness to further develop AI automation skills
  • Strong communication, collaboration and hands-on technical skills
Nice to have
  • Experience with application security platforms such as Snyk, Checkmarx or Veracode (or SonarQube, Semgrep, GitHub Advanced Security, Burp Suite, OWASP ZAP)
  • Background in application security architecture for cloud-native applications, microservices, containers and Kubernetes environments
  • Familiarity with threat modeling methodologies and tools such as STRIDE, OWASP Threat Dragon or Microsoft Threat Modeling Tool
  • Skills in DevSecOps, CI/CD security automation, Infrastructure as Code scanning and policy-as-code solutions
  • Knowledge of software supply chain security, SBOM, dependency management and third-party component security
  • Expertise in API security, OAuth 2.0, OpenID Connect, secrets management and secure application authentication patterns
  • Capability to integrate application security findings with SIEM/SOAR, ticketing or vulnerability management platforms
  • Proficiency in AI automation tools such as AI agents, Microsoft Copilot Studio, Azure OpenAI (or Amazon Bedrock, LangChain, Power Automate)
  • Understanding of AI application security risks, including prompt injection, data leakage, insecure output handling and excessive AI agent permissions
  • Familiarity with OWASP Top 10 for LLM Applications or similar AI security guidelines
  • Security certifications such as CSSLP, CISSP, CISM (or CCSP, GWAPT, GWEB, OSCP, OSWE)
  • AI-related certifications such as AI-900 or AWS Certified AI Practitioner