{"id":2139831,"url":"https://alion.io/job/tomorrow-hire-vdot-application-security-architect","title":"Application Security Architect","company":{"id":4895,"name":"Tomorrow Hire","domain":"tomorrowhire.com","url":"https://alion.io/company/tomorrowhire","size_band":null,"is_staffing_agency":true,"employer_type":"agency","is_intermediary":false,"listed_via":null,"ats_vendor":"Workable","truth_index":null},"role":"Security","role_family":"Security","seniority":"staff","employment_type":"contractor","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["Richmond, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":81,"max":101,"currency":"USD","period":"hour","gross":null,"usd_annual":202000},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":true,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"DLP","optional":false},{"name":"IAM","optional":false},{"name":"JavaScript","optional":false},{"name":"Kubernetes","optional":false},{"name":"Least Privilege","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"PKI","optional":false},{"name":"Python","optional":false},{"name":"SQL","optional":false},{"name":"Threat Modeling","optional":false},{"name":"TypeScript","optional":false}],"status":"live","first_seen_at":"2026-09-15T00:00:00Z","employer_posted_date":"2026-09-15","last_verified_at":"2026-10-21T21:14:15Z","board_verified":true,"closed_at":null,"days_open":37,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":37},"description":"Job Title: VDOT Application Security Architect\nWork Type: Hybrid\nLocation: Richmond, VA\nSalary: $81-$101/hour\nStart Date: September 21, 2026\nEnd Date: June 30, 2027\nIndustry Category: Information Technology / Cybersecurity\nEmployment Type: 1099 Contract\nRequisition ID: 810287\nOverview:\nVDOT is seeking an experienced Application Security Architect to define, implement, and oversee application security architecture across enterprise IT environments.\nThe role will establish security principles, standards, patterns, reference implementations, and technical guardrails across complex applications and technology platforms.\nThe position will support secure software development, cloud-native applications, GIS solutions, low-code/no-code platforms, Agentic AI, APIs, data platforms, and enterprise applications.\nThe Application Security Architect will work closely with architecture, development, cybersecurity, and technology teams to identify and reduce security risks.\nThe role will also support data protection, data governance, privacy, threat modeling, secure design, and compliance with Commonwealth of Virginia and VITA security requirements.\nApplication:\nInterested candidates should submit an updated resume for consideration.\nCandidates must be local to the Richmond, Virginia area.\nCandidates must physically reside within the United States for the duration of the assignment.\nCandidates must be legally authorized to work in the United States without employer sponsorship, now or in the future.\nCandidates must provide a valid email address.\nCandidates must provide their permanent city and state of residence.\nCandidates must confirm their ability to meet the required onsite schedule.\nCandidates should indicate how soon they can start after receiving an offer.\nJob Description:\nDefine, implement, and oversee application security architecture across VDOT's enterprise IT environment.\nEstablish application security principles, standards, patterns, reference implementations, and technical guardrails.\nEmbed security throughout the Secure Software Development Lifecycle (SSDLC), from requirements and architecture through development, testing, deployment, and production monitoring.\nDevelop secure architecture patterns for complex web applications, APIs, distributed systems, cloud-native workloads, GIS applications, low-code/no-code platforms, and Agentic AI solutions.\nLead application security architecture activities involving Azure, SQL Server, Microsoft Dynamics 365, Microsoft Power Platform, ArcGIS, and other enterprise technologies.\nDefine and implement security controls for data at rest, data in transit, and data in use.\nSupport data classification, encryption, Data Loss Prevention (DLP), privacy, data governance, and Data Protection Impact Assessments (DPIAs).\nDesign granular access-control models using Role-Based Access Control (RBAC), Row-Level Security, Column-Level Encryption, dynamic data masking, and centralized database audit and activity monitoring.\nAlign application security architecture and controls with VITA security requirements, including VITA SEC 530.\nConduct threat modeling and security architecture reviews to identify vulnerabilities and security risks early in the development lifecycle.\nDefine security requirements for authentication, authorization, session management, encryption, secrets management, logging, privacy, APIs, and data protection.\nIntegrate application security practices into CI/CD pipelines, Infrastructure as Code (IaC), development workflows, testing processes, and release management.\nEvaluate and support security tools including Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), container scanning, API security testing, secret scanning, and runtime security monitoring.\nSupport vulnerability management activities and help prioritize remediation based on business and technical risk.\nAssess security risks associated with third-party applications, open-source software, SaaS solutions, and external technology providers.\nEstablish secure identity and access-management patterns, including least privilege, Multi-Factor Authentication (MFA), Single Sign-On (SSO), service authentication, RBAC, Attribute-Based Access Control (ABAC), and privileged access management.\nDevelop security architecture for cloud environments, Kubernetes, serverless applications, containers, cloud IAM, network segmentation, and secrets management.\nSupport cybersecurity incident response activities and perform root-cause analysis related to application security incidents.\nMaintain architecture documentation, security risk registers, exception documentation, remediation plans, standards, and security patterns.\nCommunicate complex security risks, technical tradeoffs, and recommended solutions to technical and non-technical stakeholders.\nWork collaboratively with application development, enterprise architecture, cybersecurity, infrastructure, data, and project teams.\nResponsibilities:\nDefine and maintain application security architecture principles, standards, patterns, and reference implementations.\nConduct architecture and design reviews for applications, platforms, integrations, APIs, and cloud solutions.\nPerform threat modeling and identify application, infrastructure, data, and identity-related security risks.\nDefine security requirements for authentication, authorization, encryption, secrets, logging, privacy, APIs, and data protection.\nSupport secure coding practices and security reviews across Java, .NET, JavaScript, TypeScript, and Python applications.\nIntegrate security controls into CI/CD pipelines and DevSecOps processes.\nEvaluate and implement application security testing and monitoring tools.\nSupport vulnerability identification, prioritization, remediation, and risk acceptance.\nEstablish secure identity and access-management patterns using modern authentication and authorization technologies.\nDesign security controls for Azure, cloud-native workloads, containers, Kubernetes, serverless applications, and enterprise platforms.\nSupport data protection and privacy requirements across structured, unstructured, and spatial data.\nDevelop and maintain architecture diagrams, security standards, risk assessments, exception documentation, and remediation plans.\nSupport incident response and root-cause analysis for application security issues.\nEvaluate third-party, open-source, and SaaS security risks.\nProvide guidance to development and architecture teams on secure application design and implementation.\nEnsure application security practices align with applicable VDOT, Commonwealth of Virginia, VITA, and organizational security requirements.\nRequirements\nMinimum Qualifications:\nBachelor's degree in Computer Science, Cybersecurity, Engineering, a related field, or equivalent practical experience.\n10+ years of experience in software engineering, application security, security engineering, or related technical roles, including experience designing and implementing security architecture.\n6+ years of experience designing and implementing security architecture for IT systems, including end-to-end security architectures for data at rest, data in transit, and data in use.\n6+ years of experience applying secure software development principles and addressing application security risks, including OWASP Top 10, insecure authorization, injection, deserialization, and API abuse.\n6+ years of experience with Microsoft technology environments, including Azure, Microsoft 365/O365, Power Platform, and Dynamics 365, as well as automated data classification, Microsoft Purview, encryption, DLP, and DPIAs.\n6+ years of experience with threat modeling and security architecture reviews.\n6+ years of experience with APIs, web applications, distributed systems, cloud environments, CI/CD, and container workloads.\n6+ years of experience with identity and authentication technologies, including OAuth2, OIDC, SAML, JWT, authorization, PKI/TLS, encryption, and secrets management.\n10+ years of experience producing architecture diagrams, standards, risk assessments, remediation plans, and other technical documentation.\nExperience implementing granular access controls, including RBAC, Row-Level Security, Column-Level Encryption, dynamic masking, and centralized database audit/activity monitoring aligned with VITA SEC 530.\nExperience with secure coding practices in Java, .NET, JavaScript, TypeScript, and Python.\nAbility to explain technical security risks, business impacts, and architectural tradeoffs to technical and non-technical stakeholders.\nStrong written and verbal communication skills.\nMust be legally authorized to work in the United States without employer sponsorship, now or in the future.\nPreferred Qualifications:\n6+ years of experience working in regulated environments such as financial services, healthcare, government, or payments.\n6+ years of experience with penetration testing and translating findings into architectural improvements.\n4+ years of experience developing or supporting DevSecOps programs and security automation at scale.\n4+ years of experience with privacy engineering, data classification, and compliance frameworks.\n2+ years of experience designing or implementing Esri ArcGIS security architectures.\nExperience with certifications such as CISSP, CSSLP, CCSP, GIAC, cloud security, or relevant vendor certifications.\nBenefits\nCompensation:\nPay Rate: $81-$101/hour.\nSchedule:\nFull-time contract assignment.\nHybrid work arrangement.\nInitial 90-day probationary period requires onsite work 4 days per week.\nAfter successful completion of the initial 90-day probationary period, the onsite requirement may be reduced.\nSome weekly onsite presence will continue after the probationary period.\nCandidates must be able to meet the required onsite schedule.\nWork Location:\nRichmond, VA.","description_format":"text","description_chars":9895,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Hybrid work"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security"],"lifecycle":[{"event":"open","at":"2026-10-09T02:55:41Z"}],"visa":[],"liveness":{"score":19,"band":"cold","label":"Long shot","p_open":1,"p_active":0.415,"p_room":0.45,"age_days":36,"expected_fill_days":23,"reasons":["conf:3","agency","velocity","win:tail"],"computed_at":"2026-10-21T05:46:15Z"},"pay":{"stated_usd_annual":202000,"is_top_pay":false},"html_url":"https://alion.io/job/tomorrow-hire-vdot-application-security-architect","json_url":"https://alion.io/job/tomorrow-hire-vdot-application-security-architect.json","meta":{"generated_at":"2026-10-22T04:08:30Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":4318,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-23T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4895},"rest":"https://alion.io/mcp/rest/get_company?id=4895"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ftomorrow-hire-vdot-application-security-architect"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ftomorrow-hire-vdot-application-security-architect"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ftomorrow-hire-vdot-application-security-architect"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/tomorrow-hire-vdot-application-security-architect\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ftomorrow-hire-vdot-application-security-architect"}]}