PS, Solution Architect (Armis/Veza)

Stack

Responsibilities

• ▹Lead the Application Security program across all Armis products, embedding security throughout the SDLC
• ▹Perform secure design and architecture reviews, partnering with engineering teams to identify and mitigate risk early
• ▹Lead threat modeling sessions using STRIDE, DREAD or PASTA
• ▹Own application-layer vulnerability management as part of Armis' VIPR strategy, from detection through remediation and validation
• ▹Integrate AppSec findings (SAST, DAST, SCA, API testing) into centralized vulnerability workflows, risk scoring and prioritization models
• ▹Correlate application vulnerabilities with asset context, exploit intelligence and business criticality to drive risk-based remediation
• ▹Track and report VMDR metrics such as MTTD, MTTR, exposure windows and remediation effectiveness
• ▹Build and maintain automated AppSec pipelines for SAST, DAST, SCA and API security testing
• ▹Integrate security scanning into CI/CD pipelines (GitHub Actions, Jenkins, Buildkite) with DevOps
• ▹Secure APIs, microservices and containerized workloads (Docker, Kubernetes) with Cloud and Infrastructure Security
• ▹Develop and maintain secure coding standards and security baselines for React, Node.js, Python, Java and Go
• ▹Mentor engineers and security champions; deliver secure coding training and threat modeling workshops
• ▹Act as a trusted advisor to engineering leadership, translating vulnerabilities into clear risk and remediation guidance
• ▹Support compliance and audit readiness including SOC 2, ISO 27001, FedRAMP and HIPAA

Requirements

• ▹7-10+ years of experience in Application Security, Product Security or Secure Software Engineering
• ▹Proven expertise in SAST, DAST, SCA and dependency management tools (e.g. Veracode, Checkmarx, Fortify, Snyk, SonarQube, OWASP Dependency-Check)

Nice to have

• ▹Experience in a SaaS, cloud-native or cybersecurity product company
• ▹Hands-on experience integrating AppSec into broader VIPR or exposure management programs
• ▹Familiarity with cloud and container security platforms (Prisma Cloud, Wiz, Orca)
• ▹Experience with IaC security (Terraform, CloudFormation)
• ▹Exposure to API gateway security, OAuth2, token-based auth and zero-trust architectures
• ▹Relevant certifications such as OSWE, CSSLP, GWAPT, GWEB, CEH
• ▹Hands-on coding proficiency in at least two modern languages (Python, JavaScript/TypeScript, Java, Go)
• ▹Strong experience managing vulnerabilities end-to-end, including triage, prioritization, remediation tracking and validation
• ▹Deep understanding of OWASP Top 10, CWE, CVE and exploitability concepts
• ▹Strong knowledge of CI/CD pipelines, Git-based workflows and secure build automation
• ▹Experience with threat modeling, secure architecture reviews and microservices/API security
• ▹Ability to communicate technical risk clearly to engineering teams and business stakeholders

Soft skills

About the company

The ServiceNow AI platform brings together AI, data and workflows, helping 85% of the Fortune 500 work smarter and faster.