Solution Architect – Application Security (AppSec), Zero Trust & Compliance

Role Overview: We are seeking a highly experienced Solution Architect – Application Security Lead to drive the design, implementation, and governance of enterprise-grade App. Sec, Zero Trust architecture, and regulatory compliance frameworks. This role will be responsible for embedding security-by-design principles across application lifecycles, leading Zero Trust adoption, and ensuring alignment with regulatory and industry standards (e.

g., PCI-DSS, OSFI, NIST, ISO 27001). Application Security Strategy & Architecture

• Define and implement enterprise-wide App. Sec strategy aligned with business and security objectives Architect secure SDLC frameworks.
• SAST, DAST, SCA, IAST
• API security
• Container & cloud-native security
• Establish security patterns, reference architectures, and guardrails for application teams Drive Dev. Sec. Ops enablement across CI/CD pipelines Zero Trust Architecture Leadership
• Lead the design and rollout of Zero Trust architecture across application ecosystems.
• Implement key Zero Trust principles.
• Continuous verification
• Least privilege access
• Micro-segmentation Integrate with:
• Identity & Access Management (IAM/CIAM)
• Privileged Access Management (PAM)
• Endpoint and workload protection platforms
• Align application access controls with identity-centric security models Compliance & Regulatory Governance
• Ensure application security controls meet: OSFI B-13 / B-10 (Canada BFSI), PCI-DSS, SOX, GDPR, ISO 27001, NIST
• Drive audit readiness, control validation, and compliance reporting.
• Establish risk-based control frameworks and remediation tracking.
• Partner with internal audit, risk, and compliance teams. Secure Architecture & Threat Modeling
• Conduct secure design reviews and threat modeling (STRIDE, ATT&CK).
• Identify and mitigate application-layer vulnerabilities and attack vectors.
• Define security requirements for APIs, microservices, and cloud-native applications.
• Embed security testing and validation processes. Engineering & Tooling Enablement
• Lead deployment and optimization of App. Sec tools.
• SAST: Checkmarx, Fortify, Veracode
• DAST: Burp, App. Scan
• SCA: Snyk, Black Duck
• Container security: Prisma, Aqua
• Integrate tools into CI/CD pipelines (Azure DevOps, GitHub, Jenkins).
• Drive automation for vulnerability management and remediation tracking. Stakeholder & Delivery Leadership
• Act as a trusted advisor to engineering, architecture, and business leaders.
• Lead cross-functional teams across development, DevOps, and security.
• Provide executive-level reporting on App. Sec maturity and risk posture.
• Mentor teams on secure coding and security best practices. Required Qualifications
• 12+ years in cybersecurity, application security, or architecture roles
• Proven experience as a Solution Architect or App. Sec Lead in large enterprises (preferably BFSI) Strong expertise in:
• Secure SDLC / Dev. Sec. Ops
• Zero Trust Architecture
• Cloud platforms (Azure, AWS, GCP)
• Hands-on experience with App. Sec tools and CI/CD integrations. Deep understanding of:
• OWASP Top 10, API Security Top 10
• Threat modeling methodologies
• Experience with regulatory compliance frameworks (OSFI, PCI-DSS, ISO, NIST) Preferred Certifications:
• CISSP / CISM / CCSP
• CSSLP (Certified Secure Software Lifecycle Professional) TOGAF (Architecture) SABSA or equivalent security architecture certifications