Solution Architect – Application Security (AppSec), Zero Trust & Compliance

Role Overview: We are seeking a highly experienced Solution Architect – Application Security Lead to drive the design, implementation, and governance of enterprise-grade AppSec, Zero Trust architecture, and regulatory compliance frameworks.

This role will be responsible for embedding security-by-design principles across application lifecycles, leading Zero Trust adoption, and ensuring alignment with regulatory and industry standards (e.g., PCI-DSS, OSFI, NIST, ISO 27001).

Application Security Strategy & Architecture

· Define and implement enterprise-wide AppSec strategy aligned with business and security objectives Architect secure SDLC frameworks.

· SAST, DAST, SCA, IAST

· API security

· Container & cloud-native security

· Establish security patterns, reference architectures, and guardrails for application teams Drive DevSecOps enablement across CI/CD pipelines

Zero Trust Architecture Leadership

· Lead the design and rollout of Zero Trust architecture across application ecosystems.

· Implement key Zero Trust principles.

· Continuous verification

· Least privilege access

· Micro-segmentation

Integrate with:

· Identity & Access Management (IAM/CIAM)

· Privileged Access Management (PAM)

· Endpoint and workload protection platforms

· Align application access controls with identity-centric security models

Compliance & Regulatory Governance

· Ensure application security controls meet: OSFI B-13 / B-10 (Canada BFSI), PCI-DSS, SOX, GDPR, ISO 27001, NIST

· Drive audit readiness, control validation, and compliance reporting.

· Establish risk-based control frameworks and remediation tracking.

· Partner with internal audit, risk, and compliance teams.

Secure Architecture & Threat Modeling

· Conduct secure design reviews and threat modeling (STRIDE, ATT&CK).

· Identify and mitigate application-layer vulnerabilities and attack vectors.

· Define security requirements for APIs, microservices, and cloud-native applications.

· Embed security testing and validation processes.

Engineering & Tooling Enablement

· Lead deployment and optimization of AppSec tools.

· SAST: Checkmarx, Fortify, Veracode

· DAST: Burp, AppScan

· SCA: Snyk, Black Duck

· Container security: Prisma, Aqua

· Integrate tools into CI/CD pipelines (Azure DevOps, GitHub, Jenkins).

· Drive automation for vulnerability management and remediation tracking.

Stakeholder & Delivery Leadership

· Act as a trusted advisor to engineering, architecture, and business leaders.

· Lead cross-functional teams across development, DevOps, and security.

· Provide executive-level reporting on AppSec maturity and risk posture.

· Mentor teams on secure coding and security best practices.

Required Qualifications

· 12+ years in cybersecurity, application security, or architecture roles

· Proven experience as a Solution Architect or AppSec Lead in large enterprises (preferably BFSI)

Strong expertise in:

· Secure SDLC / DevSecOps

· Zero Trust Architecture

· Cloud platforms (Azure, AWS, GCP)

· Hands-on experience with AppSec tools and CI/CD integrations.

Deep understanding of:

· OWASP Top 10, API Security Top 10

· Threat modeling methodologies

· Experience with regulatory compliance frameworks (OSFI, PCI-DSS, ISO, NIST)

Preferred Certifications:

· CISSP / CISM / CCSP

· CSSLP (Certified Secure Software Lifecycle Professional) TOGAF (Architecture) SABSA or equivalent security architecture certifications