Application Security Architect

Portugal

Porto Salvo, Portugal

AWS

About the opportunity

Application Security Architect

Location: Portugal

IQVIA is committed to integrity in our hiring process and maintains a zero tolerance policy for candidate fraud. All information and credentials submitted in your application must be truthful and complete. Any false statements, misrepresentations, or material omissions during the recruitment process will result in immediate disqualification of your application, or termination of employment if discovered later, in accordance with applicable law. We appreciate your honesty and professionalism.

At IQVIA, we believe that diversity, inclusion, and belonging empower our mission to accelerate innovation for a healthier world. We create a culture of belonging by valuing the perspectives of all talented employees worldwide and providing them with the opportunity to power smarter healthcare for everyone, everywhere. When our talented employees bring their authentic selves and their diverse experiences to work, they enable us to accomplish extraordinary things. Multifaceted thought processes spark innovation. Multi-talented collaboration harnesses innovation to deliver superior outcomes. Likewise, as part of this culture, IQVIA is committed to ensuring effective equality between women and men, integrating it as a strategic principle in its corporate and human resources policies.

Role and Responsibilities

Protecting Personal Health Information (PHI) and other sensitive client data is a core responsibility of this position. The Application Security Architect will work with Cedar Gate application teams, who are based both in Nepal and the United States, to design and improve safeguards across healthcare applications, APIs, data exchanges, cloud services, and supporting infrastructure.

This senior, hands-on role is an embedded design and risk advisor for Cedar Gate product, development, engineering, DevOps, and infrastructure teams where all services are hosted in AWS or Snowflake. Based in Portugal and reporting to the Cedar Gate Associate Director, Security, the architect will support new applications, functionality, material changes, and technology modernization.

The role will influence Cedar Gate’s Secure SDLC and AIDLC, while engineering retains solution ownership and application security analysts perform routine testing, tooling, triage, and remediation tracking.

Principal responsibilities include

Establish risk-based review criteria for new applications, functionality, material changes, AI features, and supporting infrastructure; perform complex reviews and document requirements, decisions, exceptions, and closure evidence. Identify systemic weaknesses and modernization priorities.

Lead threat modeling for applications, APIs, administrative functions, sensitive data flows, trust boundaries, and AI-enabled features using STRIDE, misuse cases, and attack-path analysis; translate threats into design requirements.

Maintain reusable application security patterns, architecture decision records, and guidance for identity, tenant isolation, input and file handling, cryptography, secrets, logging, PHI workflows, APIs, OAuth 2.0, OpenID Connect, and service communications.

Influence the Secure SDLC and AIDLC through architecture gates, threat-modeling criteria, secure coding and AI guardrails, testing requirements, and risk-based release criteria. Address prompt injection, data leakage, insecure tool or output use, excessive agency, authorization bypass, and improper use of PHI, source code, or credentials.

Define validation requirements for AI-generated code and AI-enabled applications, including developer review, provenance and licensing, secrets and dependency scanning, SAST, SCA, DAST, API, container, infrastructure-as-code, and pre-production testing; analysts execute routine reviews.

Provide architectural guidance and escalation for testing, vulnerability management, supply-chain risk, penetration testing, and high-risk findings. Present design recommendations, tradeoffs, and remediation strategies to engineering, product, security leadership, and governance forums.

Provide senior architectural review to Nepal application and cloud security personnel for complex reviews, threat models, AI assessments, risk decisions, and systemic findings without duplicating analyst work. Align Cedar Gate patterns with IQVIA security architecture requirements.

Required Experience and Qualifications

6 or more years of progressive experience in application security, software engineering, product security, cloud security, security engineering, or application security architecture; 6–8 years of directly relevant experience is preferred.

Experience reviewing new and existing application architectures, conducting threat modeling, documenting sensitive data flows and trust boundaries, and translating threats into practical requirements; strong knowledge of application and API security, multi-tenant SaaS, identity, cryptography, secrets, logging, supply-chain risk, and PHI processing.

Experience influencing Secure SDLC and AIDLC practices, defining risk-based review and release criteria, and embedding security into CI/CD. Knowledge of SAST, SCA, DAST, API, secrets, container, infrastructure-as-code, and penetration testing; experience evaluating generated code, AI assistants, agents, LLM integrations, and sensitive-data handling is required.

Working knowledge of application-facing AWS architecture and relevant standards, including OWASP ASVS, OWASP Top 10, OWASP API Security Top 10, OWASP SAMM, OWASP LLM guidance, NIST Secure Software Development Framework, MITRE CWE, HIPAA, HITRUST, SOC 2, CIS, and NIST requirements.

Strong analytical and communication skills; ability to work predominantly during U.S. business hours with teams in the United States, Nepal, Portugal, and other IQVIA locations; fluent English; bachelor’s degree in a related field or equivalent practical experience.

Preferred Experience

Healthcare SaaS, PHI exchange, analytics, managed file transfer or sFTP, and multi-tenant platforms.

Hands-on development or DevOps experience; integration of an acquired business into enterprise AppSec practices

CSSLP, CISSP, CCSP, GIAC Web Application Defender, or relevant AWS certification.

IQVIA is a leading global provider of clinical research services, commercial insights, and healthcare intelligence to the life sciences and healthcare industries. We create intelligent connections to accelerate the development and commercialization of innovative medical treatments to help improve patient outcomes and population health worldwide. Learn more at jobs.iqvia.com.

Languages

Application Security Architect

About the opportunity

Role and Responsibilities

Principal responsibilities include

Required Experience and Qualifications

Preferred Experience

Show your skills.Get discovered.

More opportunities with one profile

Keep exploring

Platform Engineer (Backend Infrastructure)

Extracurricular Internship | Functional Consulting – AI Sales Solutions (f/m/div.)

Site Reliability Engineer