Application security Architect

Key tasks:

• Own the detection quality of the harness: triage vulnerabilities it produces, identify false positives, and feed findings back into rule, prompt and agent tuning.
• Work with the Security Architect and teams to adjust the triage taxonomy, severity model, acceptance criteria and related conventions.
• Adapt the remediation workflow (fix generation, PR flow, human-in-the-loop review) to processes and define the governance gates around it.
• Hands-on Python development of harness components and APIs — there is no separate QA seat, so own testing for what you build.
• Reduce duplicate flood and run-to-run instability of scan results; make findings reproducible across runs.
• Contribute to the design of the reporting layer for vulnerability and remediation quality metrics (false-positive rate, duplicates, time-to-remediate).
• Advise on AI-spend and model-selection trade-offs for the analysis and remediation agents.

REQUIREMENTS

Primary skills:

• Application security depth: Secure SDLC, threat modeling, SAST/SCA, dependency analysis, secure coding, and hands-on vulnerability triage / false-positive analysis. (Experience with GHAS is preferred)
• Strong programming experience in Python
• LLM-based and agentic systems (LLM/agentic workflows using OpenAI, Anthropic, Azure AI Foundry, or equivalent platforms).
• Cloud literacy (Azure and/or AWS) to own how your code runs — containers, object storage, secrets, IAM/managed identity — plus testing discipline, as there is no separate QA seat.
• SARIF and GitHub Advanced Security (GHAS).

Nice to have:

• Application-context platforms: ServiceNow, SAP LeanIX.
• Data visualization/reporting on security findings.
• GitHub Actions, Docker, Terraform.
• Experience delivering into regulated enterprise environments (financial services a plus).

Soft skills: autonomy in a small team; pragmatism about scope; willingness to work hands-on across code, security analysis, and process design.