Lead Cloud & Application Security Architect
First seen by Alion on Oct 28, 2026.
Role Overview :
We are seeking a Lead Cloud & Application Security Architect with a distinguished track record of securing enterprise-grade applications across complex, multi-cloud environments. This high-impact, hands-on leadership role serves as a technical bridge between software engineering, cloud architecture, and modern threat defense.
Key Responsibilities :
- Define multi-cloud guardrails : Architect, implement, and maintain Infrastructure as Code (IaC) security standards and zero-trust Identity and Access Management (IAM) governance across AWS, GCP, and Azure.
- Establish strategic DevSecOps pipelines : Standardize and scale automated application security testing - including SAST, DAST, SCA, and container scanning - across multi-cloud CI/CD ecosystems while minimizing false positives and preserving developer velocity.
- Lead advanced threat modeling : Direct architectural reviews and threat modeling sessions using STRIDE and PASTA for enterprise products, mapping trust boundaries across heterogeneous cloud infrastructures and distributed microservices.
- Engineer secure remediations and reference architectures : Develop reusable software libraries and secure-by-default reference architectures for encryption, multi-tenant data isolation, and secrets management.
- Champion security culture and strategy : Drive the application security roadmap, establish an enterprise-wide Security Champions program, and mentor senior engineering leads and security staff.
- Partner with engineering teams to prioritize vulnerabilities, define remediation plans, and embed security controls early in the software development lifecycle.
- Track security posture, control effectiveness, vulnerability trends, and risk metrics; communicate findings and recommendations to technical leaders and executives.
Required Qualifications :
- 8+ years of deep technical experience in application security, product security, or DevSecOps engineering; an early-career foundation in software development is preferred.
- Hands-on architecture and security experience across AWS, Google Cloud Platform (GCP), and Microsoft Azure.
- Strong knowledge of secure cloud IAM, least-privilege access, zero-trust principles, Infrastructure as Code security, and cloud governance.
- Advanced understanding of web application vulnerabilities, OWASP Top 10, API security, container security and isolation, and attacks affecting distributed systems.
- Experience designing and integrating SAST, DAST, Software Composition Analysis (SCA), and container scanning into CI/CD pipelines.
- Practical experience conducting threat modeling and architecture reviews using frameworks such as STRIDE and PASTA.
- Ability to design secure-by-default patterns for encryption, secrets management, and multi-tenant data isolation.
- Strong technical communication, collaboration, mentoring, and stakeholder management skills.
Core Technology & Frameworks :
- Cloud : AWS, GCP, Microsoft Azure
- Application Security : OWASP Top 10, API security, secure coding, container security
- DevSecOps : SAST, DAST, SCA, container scanning, CI/CD security controls
- Threat Modeling : STRIDE, PASTA, architectural risk assessment
- Cloud Security : IAM, zero trust, IaC security, KMS, secrets management, cloud governance
Skills
Security Architect, Cloud Security, DevSecOps, AWS, Azure, Google Cloud Platform, Applications Security, Cyber Security, Security, Information Security, Threat Modeling