Application Security Architect/Engineer

Job Details: Role: Application Security Architect/Engineer Location: 10 Exchange Place, Jersey City, NJ (Onsite Hybrid) Duration: Fulltime Position POSITION SUMMARY:

• The Application Security Architect will be responsible for reviewing applications to secure the organization's critical IT assets according to appropriate security practices and in compliance with client standards, policies, procedures and security architecture.
• Key duties will be the assessment of the security of applications - commercial products and inhouse developed - throughout their lifecycle, at the stages of requirements gathering, design, build, procurement and update, to ensure compliance, while enabling the business to meet the requirements of the information security technology architecture, strategy and baseline.

• Strong experience of reviewing the security of applications for alignment with security architecture, security policy, security standards and best practices.
• Experience of reviewing and contributing to corporate security architecture frameworks, security standards and security policies.
• Experience of web server, web application and API security and remediation. In-depth knowledge of OWASP Top-10 security risks and how to address them.
• Experience of application risk assessment via threat modelling using STRIDE, OCTAVE, PASTA or similar framework, and of providing recommendations to mitigate threats and reduce risk.
• Experience of using web dynamic application security testing (DAST) tools such as Burp Suite, OWASP ZAP and Checkmarx, and of providing recommendations to mitigate vulnerabilities.
• Experience of using network security assessment tools such as NMAP and Nessus and of providing recommendations to address security weaknesses identified.
• Experience or working knowledge of penetration testing methods, of interpretation of penetration test reports, and of recommendations to address findings.
• Experience of data security solutions such as encryption, hashing, digital signatures, data tokenization and masking.
• Working knowledge of multi-factor authentication and single sign-on mechanisms for applications.
• Working knowledge of Amazon Web Services and Microsoft Azure cloud computing platforms.
• Good general knowledge of core security networking concepts like TLS, SSH, DNS, firewalls.
• Good general knowledge of enterprise software, containers, operating systems and server virtualization.
• Experience of conducting product evaluations, proofs of concept, pilots and rollouts.
• A proven ability to interface across a global organization with other teams, such as EIS Engineering and Security, Corporate Applications, Enterprise Applications, Internal Audit, agency CIOs, and agency security teams and compliance coordinators, etc.
• An analytical demeanor and the ability to effectively communicate with individuals across all levels the organization.
• Excellent written and verbal communications skills.
• Ability to adjust to changing priorities while multitasking effectively.
• Working knowledge of compliance frameworks and security management standards (e.g., ISO 27001, COBIT, NIST CSF, PCI-DSS, ).
• Working knowledge of best practices/standards (e.g., PCI DSS, HIPAA, State data breach laws) for implementing application-level data encryption.
• Bachelor's degree in Computer Science, Information Security and Risk Management, Information Systems, Engineering or related major.
• CISSP, CASE, CASS, CLSSP, GIAC GWEB similar certification required.
• Solid progressive experience working in Information Technology with at least some of that directly in Information Security.
• Some experience in a security architect role with experience in reviewing and approving the security of applications.
• Advertising and marketing communications industry experience preferred.