Application Security Architect
Location: Portugal
Responsibilities
Protecting Personal Health Information (PHI) and other sensitive client data is a core responsibility of this position. The Application Security Architect will work with Cedar Gate application teams, who are based both in Nepal and the United States, to design and improve safeguards across healthcare applications, APIs, data exchanges, cloud services, and supporting infrastructure.
This senior, hands-on role is an embedded design and risk advisor for Cedar Gate product, development, engineering, DevOps, and infrastructure teams where all services are hosted in AWS or Snowflake. Based in Portugal and reporting to the Cedar Gate Associate Director, Security, the architect will support new applications, functionality, material changes, and technology modernization. The role will influence Cedar Gate's Secure SDLC and AIDLC, while engineering retains solution ownership and application security analysts perform routine testing, tooling, triage, and remediation tracking.
•Establish risk-based review criteria for new applications, functionality, material changes, AI features, and supporting infrastructure; perform complex reviews and document requirements, decisions, exceptions, and closure evidence.
•Identify systemic weaknesses and modernization priorities.
•Lead threat modeling for applications, APIs, administrative functions, sensitive data flows, trust boundaries, and AI-enabled features using STRIDE, misuse cases, and attack-path analysis; translate threats into design requirements.
•Maintain reusable application security patterns, architecture decision records, and guidance for identity, tenant isolation, input and file handling, cryptography, secrets, logging, PHI workflows, APIs, OAuth 2.0, OpenID Connect, and service communications.
•Influence the Secure SDLC and AIDLC through architecture gates, threat-modeling criteria, secure coding and AI guardrails, testing requirements, and risk-based release criteria.
•Address prompt injection, data leakage, insecure tool or output use, excessive agency, authorization bypass, and improper use of PHI, source code, or credentials.
•Define validation requirements for AI-generated code and AI-enabled applications, including developer review, provenance and licensing, secrets and dependency scanning, SAST, SCA, DAST, API, container, infrastructure-as-code, and pre-production testing; analysts execute routine reviews.
•Provide architectural guidance and escalation for testing, vulnerability management, supply-chain risk, penetration testing, and high-risk findings.
•Present design recommendations, tradeoffs, and remediation strategies to engineering, product, security leadership, and governance forums.
•Provide senior architectural review to Nepal application and cloud security personnel for complex reviews, threat models, AI assessments, risk decisions, and systemic findings without duplicating analyst work.
•Align Cedar Gate patterns with IQVIA security architecture requirements.
Requirements
•6 or more years of progressive experience in application security, software engineering, product security, cloud security, security engineering, or application security architecture; 6–8 years of directly relevant experience is preferred.
•Experience reviewing new and existing application architectures, conducting threat modeling, documenting sensitive data flows and trust boundaries, and translating threats into practical requirements; strong knowledge of application and API security, multi-tenant SaaS, identity, cryptography, secrets, logging, supply-chain risk, and PHI processing.
•Experience influencing Secure SDLC and AIDLC practices, defining risk-based review and release criteria, and embedding security into CI/CD.
•Knowledge of SAST, SCA, DAST, API, secrets, container, infrastructure-as-code, and penetration testing; experience evaluating generated code, AI assistants, agents, LLM integrations, and sensitive-data handling is required.
•Working knowledge of application-facing AWS architecture and relevant standards, including OWASP ASVS, OWASP Top 10, OWASP API Security Top 10, OWASP SAMM, OWASP LLM guidance, NIST Secure Software Development Framework, MITRE CWE, HIPAA, HITRUST, SOC 2, CIS, and NIST requirements.
•Strong analytical and communication skills; ability to work predominantly during U.S. business hours with teams in the United States, Nepal, Portugal, and other IQVIA locations; fluent English; bachelor's degree in a related field or equivalent practical experience.
•Healthcare SaaS, PHI exchange, analytics, managed file transfer or sFTP, and multi-tenant platforms experience.
•Hands-on development or DevOps experience; integration of an acquired business into enterprise AppSec practices.
•CSSLP, CISSP, CCSP, GIAC Web Application Defender, or relevant AWS certification (preferred).
About IQVIA
IQVIA is a leading global provider of clinical research services, commercial insights, and healthcare intelligence to the life sciences and healthcare industries.
