Security Architect Jobs in California

Hi,

Role : Security Architect

Work location : Sunnyvale,CA(On-site Mandatory)

Duration : On-Going Project

## Key Responsibilities

Security architecture and design review
- Review the security architecture of enterprise applications and services: trust boundaries, identity and tenancy models, authorisation models, and sensitive-data flows
- Conduct threat modelling (STRIDE or equivalent) with engineering teams and derive prioritised, testable review plans from the model
- Identify design-level weaknesses that automated tooling does not surface — perimeter and gateway bypass, internal-trust assumptions that fail under external exposure, loss of end-user identity across service-to-service hops, and client-side-enforced tenant isolation
- Review authentication and authorisation architecture: OAuth2/OIDC usage, token validation completeness, service-to-service authentication, and object- and function-level authorisation across roles and tenants
- Review data-protection design: encryption in transit and at rest, key management, secrets handling, and logging hygiene for sensitive data
- Review platform architecture: container and Kubernetes security posture, infrastructure-as-code, and cloud IAM least privilege

Target-state design and patterns
- Specify target-state designs for architectural weaknesses, not problem statements alone
- Develop and publish reusable secure-design patterns and reference architectures for adoption across engineering teams
- Act as the design authority engineering teams consult before implementing security remediation
- Feed systemic recommendations into SDLC and CI/CD controls to prevent recurrence

Assurance and standards
- Define security review standards, assessment criteria and scoring or rating models, and defend them under challenge
- Assess applications against those standards and produce the resulting assurance findings and ratings
- Provide technical direction and quality assurance for a small security review team, including offshore members
- Mentor engineers in architecture-level security review

Stakeholder engagement
- Partner with central information security functions on assessment scope, coverage and findings
- Advise application owners and engineering leads on remediation design and prioritisation
- Escalate risks and blockers clearly and early

---

## Required Skills and Experience

- 10+ years in application or product security, including time in a named security architect or design authority role on enterprise systems
- Demonstrable track record of identifying design-level security weaknesses and specifying target-state designs that were adopted
- Experience authoring reference architectures or secure-design patterns used by multiple engineering teams
- Experience on, or running, an architecture or design review board or equivalent design gate
- Threat modelling at architecture level, including facilitating sessions with teams new to the practice
- Java and Spring Boot secure design and code review, including Spring Security and API gateway layers; awareness of reactive/non-blocking codebases
- Identity and access architecture — OAuth2/OIDC, JWT validation, federated enterprise identity providers, service-to-service authentication (HMAC-signed requests, app-to-app token exchange), session and token lifecycle
- Multi-tenant authorisation architecture — broken object- and function-level authorisation, tenant isolation design and verification
- Cloud and container security architecture — Kubernetes and Helm, container hardening, infrastructure-as-code review, cloud IAM across at least two major providers
- Working knowledge of OWASP ASVS, OWASP Top 10, OWASP API Security Top 10, and **CVSS v4.0
- Experience handling confidential or regulated data under a formal classification scheme
- Ability to build the security model of a proprietary or undocumented internal framework from its source code
- Strong written communication — designs, findings and rationale must be actionable by engineers
- Ability to influence without direct authority, and to work credibly with both central security functions and delivery teams

---

## Preferred

- AI / LLM application security architecture — retrieval-augmented generation design, tenant isolation on retrieval, prompt and template provenance, treating model output as untrusted, agent and tool credential scope, Model Context Protocol (MCP) exposure
- Hands-on security testing or penetration testing background, sufficient to validate and demonstrate a finding
- API security architecture and authorisation-matrix testing
- Software supply chain, SBOM and dependency risk management
- Experience establishing a security assurance programme where no formal process previously existed
- Familiarity with enterprise CI/CD security gates (SAST, SCA, secrets scanning)

---

## Certifications

Demonstrable architectural depth is weighted above certification. One or more of the following is expected:

- CISSP, **CSSLP, **CISSP-ISSAP, or **SABSA
- Valuable additions: CCSP, **CKS, **OSCP, **GWAPT, or a recognised threat-modelling credential

---

## Education

Bachelor's degree in Computer Science, Information Security, Engineering or a related field — or equivalent professional experience.

Pay: $65.00 - $70.00 per hour

Expected hours: 40.0 per week

Work Location: In person