{"id":3026193,"url":"https://alion.io/job/rocket-companies-staff-application-security-architect","title":"Staff Application Security Architect","company":{"id":1967610,"name":"Rocket Companies","domain":"rocket.com","url":"https://alion.io/company/rocket-com","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":75,"open_postings":8,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":23,"computed_at":"2026-10-23T05:54:15Z"}},"role":"Security","role_family":"Security","seniority":"staff","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Seattle, United States","Detroit, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":149000,"max":318000,"currency":"USD","period":"year","gross":null,"usd_annual":318000},"salary_estimate":null,"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CI/CD","optional":false},{"name":"Docker","optional":false},{"name":"Java","optional":false},{"name":"Kubernetes","optional":false},{"name":"Least Privilege","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"OWASP ASVS","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Shift-Left Security","optional":false},{"name":"STRIDE","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Zero Trust","optional":false}],"status":"live","first_seen_at":"2026-07-21T00:00:00Z","employer_posted_date":"2026-07-21","last_verified_at":"2026-10-22T03:58:41Z","board_verified":true,"closed_at":null,"days_open":94,"trust":{"level":"stale","repost_count":0,"flags":["stale"],"days_open":94},"description":"As the Senior Application Security Architect, you work strategically with engineering and product teams to enable the delivery of secure application patterns and software solutions. You design standard security requirements for how applications should be built, deployed, and maintained, ensuring security is baked into the software development lifecycle from the start. You also build and mature team processes that empower development teams to own their software's security posture while mentoring internal security team members.\nAbout therole\nPerform Security Reviews of applications throughout the SDLC including at the design and implementation phases through formal threat modeling and source code reviews, focusing on designing secure applications from the start and ensuring secure design principles are correctly implemented.\n\nHelp to set strategic direction for application security initiatives, shift-left processes, and secure coding standards across the enterprise with a focus on treating security as quality.\n\nBuild relationships and collaborate with software engineering, product, and architecture teams to ensure alignment of company vision and secure coding goals.\n\nContinually identify opportunities for improvement within software delivery pipelines and work with engineering leadership to implement automated security guardrails and remediations.\n\nCollaborate with business, product owners, architecture, and information security teams to enable the delivery of secure software patterns that support business velocity\n\nCoordinate and drive initiatives for AppSec engineers to build, execute, and scale application security strategies.\n\nHelp to build processes that test the compliance and effectiveness of software security requirements through automated guardrails and continuous security testing.\n\nInfluence decision-makers in the areas of secure application architecture, API design, authentication/authorization controls, and modern cloud deployment.\n\nCreate and evangelize application security policy sets and secure design patterns to be used throughout the company that balance velocity and external compliance requirements.\n\nWork directly with development and audit teams to help align security architectures against upcoming compliance, regulatory (e.g., SSDF, Executive Orders on Cybersecurity), and contractual landscapes.\n\nMentor software engineers and information security team members on threat modeling, secure code design, and modern vulnerability remediation techniques.\n\nAboutyou\nMinimum Qualifications\n10 years of experience in an information security, application development with a secure coding background or software engineering role with a focus on secure code & design principles, OR bachelor’s degree in computer science, information security, or a related field and 5 years of experience.\n\nProven experience performing architectural threat modeling on complex systems and applications using formal frameworks (e.g., STRIDE, DREAD, PASTA)\n\nStrong ability to read, write, and audit code for security vulnerabilities, with the ability to provide engineering teams with precise, actionable remediation guidance\n\nDeep technical familiarity with Java ecosystem (strongly preferred), as well as .NET and/or Python\n\nProficiency in at least one scripting language (e.g., PowerShell, Bash, Python) for automation and custom tooling\n\nDemonstrated aptitude for leveraging AI-assisted engineering tools to drive operational efficiency, balanced with the critical thinking required to identify, validate, and correct AI inaccuracies or hallucinations\n\nPractical experience or working knowledge of the following:\nSecure SDLC frameworks\n\nDevSecOps pipeline integration (CI/CD)\n\nSAST /DAST/SCA/Secret Scanning tooling\n\nIdentity and access management (OAuth 2.0, OIDC, SAML)\n\nContainer security (Docker, Kubernetes)\n\nOWASP Top 10 / ASVS mappings\n\nFamiliarity with the MITRE ATT&CK Framework\n\nStrong knowledge of fundamental InfoSec concepts, such as least privilege, zero trust architectures, secure input validation, layered security, secure defaults, etc.\n\nDeep understanding of modern enterprise security risks such as software supply chain Security, securing & hardening development environments, and identifying and mitigating risk at scale.\n\nPreferred Qualifications\nMaster’s degree in computer science, information security, or a related field\n\nAdvanced expertise in architectural threat modeling and building automated threat modeling capabilities into developer workflows\n\nOSCP, OSWE, GWAPT, CISSP, CCSP, or other relevant security certifications\n\nHands-on experience scaling AppSec programs across large engineering organizations, including, integrating secure solutions across an organization’s SDLC, and/or experience administering a developer security champion program\n\nStrong technical experience with Java\n\nWhatyou’llget\nOur team members fuel our strategy,innovationand growth, so we ensure the health and well-being of not just you, but your family, too! We goabove and beyondto give you the support you need on an individual level and offer all sorts of ways to help you live your best life. We are proud to offer eligible team members perks and health benefits that will help you have peace of mind. Simply put:We’vegot your back. Check out our full list ofBenefits and Perks.\nOn-Call Expectations\nThis role may include participation in an on-call rotation to support production systems and ensure service reliability. On-call responsibilities may include coverage during nights and weekends. If applicable, frequency and scheduling will bedeterminedby team needs and communicated accordingly.\nAboutus\nRocket is a Detroit-based company made up of businesses that provide simple,fastand trusted digital solutions for complex transactions. The name comes from our flagship business, now known as Rocket Mortgage®, which was founded in 1985. Today,we’rea publicly traded company involved in many different industries, including mortgages, fintech, realestateand more.We’reinsistently different in how we look at the world and are committed to an inclusive workplace where every voice is heard.Apply today to join a team that offers career growth, amazingbenefitsand the chance to work with leading industry professionals.\nThis job description is an outline of the primary responsibilities of this position and may bemodifiedat the discretion of thecompany at any time. Decisions related to employment are not based on race, color, religion, national origin, sex, physical or mental disability, sexual orientation, gender identity or expression, age, military or veteran status or any other characteristic protected by state or federal law. Thecompany provides reasonableaccommodationsto qualified individuals with disabilitiesin accordance withapplicable state and federal laws. Applicantsrequiringreasonable accommodations in completing the application and/orparticipatingin the application process should contact a member of the Human Resources team, .\nThe compensation information below is provided in compliance with all applicable job posting disclosure requirements. The compensation for this position is$149,000.00-$318,000.00.The position may also be eligible for an annual bonus, incentives, and other employment-related benefits including, but not limited to, medical, dental, and vision benefits, 401K retirement plan, and paid-time off. More informationregardingthese benefits and others can be found here. The informationregardingcompensation and other benefits included in this paragraph is the company’s current, good faithestimateat the time of posting. [Compensation and benefits are subject to modification from time to time as the Company, in its sole and exclusive discretion,deemsappropriate.] The Company maydetermineduring its future reviews of the proposed compensation and benefits provided for this position, that the compensation and benefits for suchpositionshould be reduced. In no event will the Company reduce the compensation for the position to a level below the applicable jurisdictional minimum wage rate for the position. Los Angeles County and San Francisco Candidates only: qualified applicants with arrest or conviction records will be considered for employment per the Fair Chance Ordinance and the Fair Chance Initiative for Hiring.","description_format":"text","description_chars":8338,"description_truncated":false,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["401k plan","Retirement plans"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Real Estate Brokerage","Personal Finance Apps & Education","Mortgage Lending & Brokers"],"lifecycle":[{"event":"open","at":"2026-10-21T19:09:15Z"}],"visa":[],"liveness":{"score":15,"band":"cold","label":"Long shot","p_open":1,"p_active":0.542,"p_room":0.28,"age_days":94,"expected_fill_days":23,"reasons":["conf:25","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-23T05:54:15Z"},"pay":{"stated_usd_annual":318000,"is_top_pay":true},"html_url":"https://alion.io/job/rocket-companies-staff-application-security-architect","json_url":"https://alion.io/job/rocket-companies-staff-application-security-architect.json","meta":{"generated_at":"2026-10-23T19:40:51Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":765,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-24T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1967610},"rest":"https://alion.io/mcp/rest/get_company?id=1967610"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Frocket-companies-staff-application-security-architect"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Frocket-companies-staff-application-security-architect"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Frocket-companies-staff-application-security-architect"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/rocket-companies-staff-application-security-architect\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Frocket-companies-staff-application-security-architect"}]}