{"id":1465298,"url":"https://alion.io/job/capital-com-application-security-architect","title":"Application Security Architect","company":{"id":949,"name":"Capital.com","domain":"capital.com","url":"https://alion.io/company/capital","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":{"grade":"A","score":86,"open_postings":17,"ghost_share":0,"stale_share":0.353,"repost_share":0,"time_to_fill_p50_days":125,"computed_at":"2026-10-01T05:45:00Z"}},"role":"Security","role_family":"Security","seniority":"staff","employment_type":null,"work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Warsaw, Poland"],"countries":["PL"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":71000,"max_usd":132000,"period":"year","method":"role_seniority_country_cell","sample_n":15},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"CI/CD","optional":false},{"name":"Docker","optional":false},{"name":"GCP","optional":false},{"name":"GraphQL","optional":false},{"name":"Kubernetes","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP ASVS","optional":false},{"name":"Rest API","optional":false},{"name":"GDPR","optional":true},{"name":"PCI DSS","optional":true}],"status":"live","first_seen_at":"2026-09-29T10:17:39Z","employer_posted_date":"2026-09-29","last_verified_at":"2026-10-01T10:04:04Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"Capital.com builds and operates web and mobile trading platforms, public and partner APIs, and the backend services behind them, all in a highly regulated environment. As Application Security Architect, you will be the senior design authority for the security of these products. You will set the direction for how we secure software at scale: you will own secure-by-design patterns and standards, lead threat modelling and architecture reviews, and define the application security baseline that engineering teams build against.\nWorking closely with the Product Security team and the Director of Product Security, you will guide AppSec processes and set the vision for your area without direct line management. You will treat security as a shared outcome rather than a gate, balancing strong protection with developer experience and delivery speed, and you will earn adoption through enablement rather than mandates.\nResponsibilities:\nSecurity Architecture & Standards:\nDefine and maintain secure-by-default reference architectures for common patterns: web apps, mobile backends, microservices, public and partner APIs, and event-driven services\nOwn core application security architecture decisions: authentication and authorisation, session management, API security, secrets management, multi-tenant isolation, and security logging and auditing\nLead the redesign of user authentication and the delivery of security features into the product\nDevelop and roll out application security standards, secure-coding guidelines, configuration standards, reusable design patterns, and architecture decision records (ADRs) that engineers can apply without a security expert in the room\nDefine internal policies for the safe use of AI-assisted and vibe-coding tools\nDefine security requirements for acquired technology and guide its secure integration\nThreat Modelling & Design Review:\nEstablish and run a threat-modelling operating model, covering scope, cadence, templates, and facilitation, proportionate to each product's risk tier\nOwn the security review stage of the new product approval process, covering architecture design and configuration\nLead design reviews for high-impact initiatives: new products, new auth flows, payment and sensitive-data flows, platform migrations, and major refactors\nIdentify design-level risks and agree practical, prioritised mitigations with engineering teams\nSecure SDLC, DevSecOps & Supply Chain:\nAssess the current state of application security, propose improvements, and drive the secure SDLC strategy with Engineering and Security leadership\nOversee AppSec processes and own the tooling strategy (SAST, DAST, IAST, SCA, and secrets scanning), including how findings flow back to engineering\nEmbed security controls as guardrails in CI/CD through policy-as-code, with agreed enforcement and escalation paths\nPartner with DevOps to organise repository management and prevent supply-chain attacks, covering safe component usage, dependency management, SBOMs, and build integrity\nImprove the security of our internal tools\nRequirements:\nExperience:\n8+ years in technology, including 5+ years in a dedicated application or product security role, with a strong engineering background and hands-on architecture or design ownership\nProven track record creating, documenting, and rolling out security standards, patterns, and best practices across a complex engineering organisation\nDeep, demonstrable threat-modelling experience across product portfolios\nTechnical:\nExperience designing and implementing a secure SDLC in a cloud-native environment. Strong AWS knowledge is required, and exposure to GCP or other clouds is welcome\nStrong command of OWASP standards (Top 10, ASVS) and DevSecOps practice, including AppSec tooling (SAST, DAST, IAST, SCA, secrets scanning) and vulnerability management\nDeep understanding of modern distributed architectures: microservices, REST and GraphQL APIs, event-driven systems, OAuth2/OIDC, and containerised workloads (Docker, Kubernetes). You should be able to reason about their trust boundaries, attack surface, and data flows across web and mobile clients\nCollaboration:\nExceptional ability to influence and align engineering teams without direct authority, and to brief both engineers and executives\nPragmatism and strategic thinking: you balance the ideal with the achievable, protect delivery throughput, and turn long-term direction into an actionable plan\nClear written communication through diagrams, ADRs, and patterns, plus a track record of mentoring and cross-functional collaboration\nNice to have:\nExperience in fintech, trading, brokerage, or another regulated environment\nAwareness of relevant regulatory and compliance drivers: FCA and CySEC operational resilience, GDPR, and PCI DSS\nSoftware supply-chain security, including SBOMs and artifact and build integrity\nExperience securing AI-integrated product features, or using AI to scale an AppSec programme\nExperience building or running a Security Champions programme\nCSSLP, GIAC GDSA, or a hands-on offensive security certification. Certifications are valued but secondary to demonstrated experience\nWhat you'll get in return:\nYou will join the company, that cares about work and life balance\nAnnual Bonus based on the performance review cycle\nGenerous Annual Leave Policy\nMedical Insurance and Pension fund, with additional benefit packages based on the location\nHybrid working model (3 days from our modern office and 2 days fully remotely)\nComprehensive Workation Policy with 30 more remote days available.\nPossibility of taking two additional days of paid leave per year to dedicate to volunteering efforts.","description_format":"text","description_chars":5645,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Annual leave","Health insurance","Hybrid work"],"hiring_locations":[{"name":"Bulgaria","iso":"BG","kind":"country"},{"name":"Cyprus","iso":"CY","kind":"country"},{"name":"Poland","iso":"PL","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Blockchain & Crypto"],"lifecycle":[{"event":"open","at":"2026-09-29T14:38:29Z"}],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":1,"expected_fill_days":125,"reasons":["conf:6","velocity","win:early"],"computed_at":"2026-10-01T05:45:00Z"},"pay":null,"html_url":"https://alion.io/job/capital-com-application-security-architect","json_url":"https://alion.io/job/capital-com-application-security-architect.json","meta":{"generated_at":"2026-10-01T19:14:25Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","usage":{"tier":"crawler","counted_by":"address","units_charged":1,"used_today":1724,"day_limit":5000,"remaining_today":3276,"minute_limit":60,"resets_at":"2026-10-02T00:00:00Z"}}}