Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 19 days ago

VDOT Application Security Architect

Workable (global search)108,016 open roles

Where
Richmond, VA, United States
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowVDOT Application Security ArchitectWorkable (global search) · Richmond, VA, United States

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Workable (global search)'s own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

7.9% of postings close within 7 days. Measured by our own scanner across the market. Workable (global search) postings stay open a median of 7 days.

Share of postings closed within
  1. 1.6%1 day
  2. 3.6%3 days
  3. 7.9%7 days
  4. 14.9%14 days
  5. 34.0%30 days
This job: posted 19 days ago

Workable (global search) median: 7 days open

The posting

  • Job Title: VDOT Application Security Architect
  • Work Type: Hybrid
  • Location: Richmond, VA
  • Salary: $81–$101/hour
  • Start Date: September 21, 2026
  • End Date: June 30, 2027
  • Industry Category: Information Technology / Cybersecurity
  • Employment Type: 1099 Contract
  • Requisition ID: 810287

Overview:

  • VDOT is seeking an experienced Application Security Architect to define, implement, and oversee application security architecture across enterprise IT environments.
  • The role will establish security principles, standards, patterns, reference implementations, and technical guardrails across complex applications and technology platforms.
  • The position will support secure software development, cloud-native applications, GIS solutions, low-code/no-code platforms, Agentic AI, APIs, data platforms, and enterprise applications.
  • The Application Security Architect will work closely with architecture, development, cybersecurity, and technology teams to identify and reduce security risks.
  • The role will also support data protection, data governance, privacy, threat modeling, secure design, and compliance with Commonwealth of Virginia and VITA security requirements.

Application:

  • Interested candidates should submit an updated resume for consideration.
  • Candidates must be local to the Richmond, Virginia area.
  • Candidates must physically reside within the United States for the duration of the assignment.
  • Candidates must be legally authorized to work in the United States without employer sponsorship, now or in the future.
  • Candidates must provide a valid email address.
  • Candidates must provide their permanent city and state of residence.
  • Candidates must confirm their ability to meet the required onsite schedule.
  • Candidates should indicate how soon they can start after receiving an offer.

Job Description:

  • Define, implement, and oversee application security architecture across VDOT's enterprise IT environment.
  • Establish application security principles, standards, patterns, reference implementations, and technical guardrails.
  • Embed security throughout the Secure Software Development Lifecycle (SSDLC), from requirements and architecture through development, testing, deployment, and production monitoring.
  • Develop secure architecture patterns for complex web applications, APIs, distributed systems, cloud-native workloads, GIS applications, low-code/no-code platforms, and Agentic AI solutions.
  • Lead application security architecture activities involving Azure, SQL Server, Microsoft Dynamics 365, Microsoft Power Platform, ArcGIS, and other enterprise technologies.
  • Define and implement security controls for data at rest, data in transit, and data in use.
  • Support data classification, encryption, Data Loss Prevention (DLP), privacy, data governance, and Data Protection Impact Assessments (DPIAs).
  • Design granular access-control models using Role-Based Access Control (RBAC), Row-Level Security, Column-Level Encryption, dynamic data masking, and centralized database audit and activity monitoring.
  • Align application security architecture and controls with VITA security requirements, including VITA SEC 530.
  • Conduct threat modeling and security architecture reviews to identify vulnerabilities and security risks early in the development lifecycle.
  • Define security requirements for authentication, authorization, session management, encryption, secrets management, logging, privacy, APIs, and data protection.
  • Integrate application security practices into CI/CD pipelines, Infrastructure as Code (IaC), development workflows, testing processes, and release management.
  • Evaluate and support security tools including Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), container scanning, API security testing, secret scanning, and runtime security monitoring.
  • Support vulnerability management activities and help prioritize remediation based on business and technical risk.
  • Assess security risks associated with third-party applications, open-source software, SaaS solutions, and external technology providers.
  • Establish secure identity and access-management patterns, including least privilege, Multi-Factor Authentication (MFA), Single Sign-On (SSO), service authentication, RBAC, Attribute-Based Access Control (ABAC), and privileged access management.
  • Develop security architecture for cloud environments, Kubernetes, serverless applications, containers, cloud IAM, network segmentation, and secrets management.
  • Support cybersecurity incident response activities and perform root-cause analysis related to application security incidents.
  • Maintain architecture documentation, security risk registers, exception documentation, remediation plans, standards, and security patterns.
  • Communicate complex security risks, technical tradeoffs, and recommended solutions to technical and non-technical stakeholders.
  • Work collaboratively with application development, enterprise architecture, cybersecurity, infrastructure, data, and project teams.

Responsibilities:

  • Define and maintain application security architecture principles, standards, patterns, and reference implementations.
  • Conduct architecture and design reviews for applications, platforms, integrations, APIs, and cloud solutions.
  • Perform threat modeling and identify application, infrastructure, data, and identity-related security risks.
  • Define security requirements for authentication, authorization, encryption, secrets, logging, privacy, APIs, and data protection.
  • Support secure coding practices and security reviews across Java, .NET, JavaScript, TypeScript, and Python applications.
  • Integrate security controls into CI/CD pipelines and DevSecOps processes.
  • Evaluate and implement application security testing and monitoring tools.
  • Support vulnerability identification, prioritization, remediation, and risk acceptance.
  • Establish secure identity and access-management patterns using modern authentication and authorization technologies.
  • Design security controls for Azure, cloud-native workloads, containers, Kubernetes, serverless applications, and enterprise platforms.
  • Support data protection and privacy requirements across structured, unstructured, and spatial data.
  • Develop and maintain architecture diagrams, security standards, risk assessments, exception documentation, and remediation plans.
  • Support incident response and root-cause analysis for application security issues.
  • Evaluate third-party, open-source, and SaaS security risks.
  • Provide guidance to development and architecture teams on secure application design and implementation.
  • Ensure application security practices align with applicable VDOT, Commonwealth of Virginia, VITA, and organizational security requirements.

Requirements

Minimum Qualifications:

  • Bachelor's degree in Computer Science, Cybersecurity, Engineering, a related field, or equivalent practical experience.
  • 10+ years of experience in software engineering, application security, security engineering, or related technical roles, including experience designing and implementing security architecture.
  • 6+ years of experience designing and implementing security architecture for IT systems, including end-to-end security architectures for data at rest, data in transit, and data in use.
  • 6+ years of experience applying secure software development principles and addressing application security risks, including OWASP Top 10, insecure authorization, injection, deserialization, and API abuse.
  • 6+ years of experience with Microsoft technology environments, including Azure, Microsoft 365/O365, Power Platform, and Dynamics 365, as well as automated data classification, Microsoft Purview, encryption, DLP, and DPIAs.
  • 6+ years of experience with threat modeling and security architecture reviews.
  • 6+ years of experience with APIs, web applications, distributed systems, cloud environments, CI/CD, and container workloads.
  • 6+ years of experience with identity and authentication technologies, including OAuth2, OIDC, SAML, JWT, authorization, PKI/TLS, encryption, and secrets management.
  • 10+ years of experience producing architecture diagrams, standards, risk assessments, remediation plans, and other technical documentation.
  • Experience implementing granular access controls, including RBAC, Row-Level Security, Column-Level Encryption, dynamic masking, and centralized database audit/activity monitoring aligned with VITA SEC 530.
  • Experience with secure coding practices in Java, .NET, JavaScript, TypeScript, and Python.
  • Ability to explain technical security risks, business impacts, and architectural tradeoffs to technical and non-technical stakeholders.
  • Strong written and verbal communication skills.
  • Must be legally authorized to work in the United States without employer sponsorship, now or in the future.

Preferred Qualifications:

  • 6+ years of experience working in regulated environments such as financial services, healthcare, government, or payments.
  • 6+ years of experience with penetration testing and translating findings into architectural improvements.
  • 4+ years of experience developing or supporting DevSecOps programs and security automation at scale.
  • 4+ years of experience with privacy engineering, data classification, and compliance frameworks.
  • 2+ years of experience designing or implementing Esri ArcGIS security architectures.
  • Experience with certifications such as CISSP, CSSLP, CCSP, GIAC, cloud security, or relevant vendor certifications.

Benefits

Compensation:

  • Pay Rate: $81–$101/hour.

Schedule:

  • Full-time contract assignment.
  • Hybrid work arrangement.
  • Initial 90-day probationary period requires onsite work 4 days per week.
  • After successful completion of the initial 90-day probationary period, the onsite requirement may be reduced.
  • Some weekly onsite presence will continue after the probationary period.
  • Candidates must be able to meet the required onsite schedule.

Work Location:

  • Richmond, VA.
From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Workable (global search)'s own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Workable (global search)'s form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Workable (global search)'s answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.