Application Security Architect + AI

We are seeking an experienced Application Security Architect with a passion for AI-driven security innovation to join our team.

In this role, you will design and implement robust security architectures for enterprise applications while leveraging AI-assisted tools to enhance application security practices. You will collaborate across engineering, DevOps, cloud and compliance teams to embed security into every stage of the software development lifecycle.

Responsibilities

• Design and implement security architectures and controls for enterprise applications, APIs, microservices and cloud-native applications
• Gather business, technical and compliance requirements to design secure application solutions for new implementations, migrations and security improvements
• Define and improve application security capabilities, including authentication, authorization, API security, encryption, secrets management and secure configuration
• Conduct security architecture reviews, threat modeling, secure design assessments and application security risk analysis
• Develop application security reference architectures, security standards, secure design patterns and secure development guidelines
• Support Secure Software Development Lifecycle (SSDLC), secure-by-design principles and DevSecOps integration across engineering teams
• Evaluate and improve application security technologies and processes, including SAST, DAST, SCA, secrets scanning and vulnerability management
• Review application security vulnerabilities, identify architectural weaknesses and recommend appropriate remediation strategies
• Collaborate with development, DevOps, cloud, infrastructure, IAM, security operations and compliance teams to integrate security into application design and development
• Leverage AI-assisted tools and workflows to improve application security activities such as threat modeling, vulnerability assessment, secure code review, compliance analysis, security scripting and workflow automation
• Identify opportunities for AI-assisted application security automation while ensuring appropriate validation, data protection and human oversight
• Communicate application security risks, architectural decisions and remediation plans to stakeholders and security leadership

Requirements

• Bachelor's degree in Computer Science, Cybersecurity, Engineering, or equivalent practical experience
• 5+ years of information security experience, with a focus on application security architecture, secure application design or application security engineering
• Background in delivering or significantly contributing to application security architecture, secure development, DevSecOps integration or application security improvement projects
• Expertise in application security, including identifying vulnerabilities, assessing security risks and recommending technical security controls
• Understanding of application security principles, OWASP Top 10, secure coding practices, API security, authentication, authorization and common vulnerability mitigation techniques
• Proficiency in application security architecture reviews, threat modeling, secure design assessments or security risk analysis
• Familiarity with application security tools and technologies such as SAST, DAST, SCA or secrets scanning solutions
• Knowledge of Secure SDLC, DevSecOps, CI/CD security and secure-by-design principles
• Working knowledge of at least one programming language such as Python, Java or C# (or JavaScript/TypeScript, Go), sufficient to review code and assess application security risks
• Competency in related security domains, including cloud security, IAM, network security, data protection and security operations
• Understanding of security architecture frameworks such as Zero Trust, NIST, ISO 27001 or OWASP guidelines
• Skills in application security automation, scripting and security tooling integration
• Intermediate practical experience with AI-assisted tools and automation, including using AI for vulnerability analysis and threat modeling, applying structured prompting, generating and validating scripts or secure code recommendations, simplifying repetitive workflows and configuring AI-assisted integrations
• Understanding of safe AI usage, including data protection, access control and validation of AI-generated outputs, with willingness to further develop AI automation skills
• Strong communication, collaboration and hands-on technical skills

Nice to have

• Experience with application security platforms such as Snyk, Checkmarx or Veracode (or SonarQube, Semgrep, GitHub Advanced Security, Burp Suite, OWASP ZAP)
• Background in application security architecture for cloud-native applications, microservices, containers and Kubernetes environments
• Familiarity with threat modeling methodologies and tools such as STRIDE, OWASP Threat Dragon or Microsoft Threat Modeling Tool
• Skills in DevSecOps, CI/CD security automation, Infrastructure as Code scanning and policy-as-code solutions
• Knowledge of software supply chain security, SBOM, dependency management and third-party component security
• Expertise in API security, OAuth 2.0, OpenID Connect, secrets management and secure application authentication patterns
• Capability to integrate application security findings with SIEM/SOAR, ticketing or vulnerability management platforms
• Proficiency in AI automation tools such as AI agents, Microsoft Copilot Studio, Azure OpenAI (or Amazon Bedrock, LangChain, Power Automate)
• Understanding of AI application security risks, including prompt injection, data leakage, insecure output handling and excessive AI agent permissions
• Familiarity with OWASP Top 10 for LLM Applications or similar AI security guidelines
• Security certifications such as CSSLP, CISSP, CISM (or CCSP, GWAPT, GWEB, OSCP, OSWE)
• AI-related certifications such as AI-900 or AWS Certified AI Practitioner

We offer

CONTINUOUS UPSKILLING, LEARNING & DEVELOPMENT

• Diversity of tasks and projects
• Assessment center for objective review of competency level
• Personal development plan
• Mentoring programs and leadership development
• Certification and professional development support 
• Access to learning platforms including more than 2,500 internal courses
• English courses taught by certified teachers

CORPORATE BENEFITS

• Extra leave days
• Referral bonuses

COMPENSATION PACKAGE

• Competitive compensation paid in USD
• Regular salary and performance reviews

MEDICAL & HEALTHCARE

• Private health insurance
• Well-being events

WORKING ENVIRONMENT

• Recreation areas and kitchens
• Tea, coffee and snacks
• Sports equipment and game consoles
• IT Equipment
• Microsoft’s Software Assurance Home Use Program (HUP)

Please note that our Talent Attraction Team reviews applications and CVs submitted in English.

EPAM is global leader in AI transformation engineering and integrated consulting, serving Forbes Global 2000 companies and ambitious startups. With over thirty years of expertise in custom software, product and platform engineering, we empower our clients to become AI-Native enterprises, driving measurable value from innovation and digital investments.

Remote in Türkiye