Sr. Application Security Architect

About the role

WEX is a global leader in financial technology solutions, based in Portland, Maine, United States, with over 6,000 WEXers distributed in over 40 countries. We simplify the complexities of payment systems across continents and industries like Fleet, Corporate Payments, and Benefits. We look to manage employee benefits, streamline how companies pay and get paid by suppliers, save on fuel costs, or modernize how companies manage their fleet, WEX solutions reduce the administrative burdens. Who Are We? We're the Global Product Security Team at WEX, responsible for enabling a modern and effective Secure Software Development Lifecycle throughout WEX.. We partner closely with internal teams and customers to assure WEX operates in a secure and compliant manner. Our team holds itself to a high-standard and we collaborate closely with one another to ensure strong, reliable and effective relationships. We own our results and we take pride of ownership in everything we do. We need help! Changing the world isn't easy, and we have a lot of work ahead of us. From securing applications, data centers and cloud resources, we've got more work than we can handle and we're looking for great people to come along for the ride. Who are you? Culturally, you're: A highly motivated security architect who loves working on small, high performing teams that interface with the entire enterprise A collaborative, solid communicator who works well with your team and stakeholders to drive projects from inception to completion Someone who cares deeply for team results but is able to work independently to deliver high quality solutions for projects and operational tasks Comfortable balancing the need to move fast with the realities of working in a highly regulated organization Passionate about security, but pragmatic about delivering business value Customer focused - whether it's internal teams that we're supporting or the WEX partner, you prioritize ensuring they have a great experience with WEX and our team A skilled worker that has the motivation, expertise, and work ethic to operate independently across global time zones, and who is able to complete tasks and deliverables with minimal oversight A strong leader who builds consensus and drives change through buy-in and education rather than mandates Work closely with development teams on securing Wex's applications Able to mentor other engineers & architects on your team and other teams both technically and professionally Champion of a shift-left and DevSecOps approach to security, but tenacious enough to build such a program from the ground up A lifelong learner that is excited by new technologies and challenges Technically, you : Are a Subject Matter Expert in software development and software security, particularly with web applications, APIs, mobile apps and enterprise applications delivered in a SaaS model. Provide leadership and help shape the WEX application security program and strategy Have a deep understanding of web application attacks and mitigations Think strategically about and research the latest trends in identity management, software attacks and mitigations Mentor and lead threat modeling sessions, focused primarily on teaching others to effectively practice effective and lightweight threat modeling Train other team members in risk based analysis of issues uncovered in manual and automated secure code reviews, and commercial static and dynamic application security scanning tools (SAST, DAST, SCA, etc) Do web application and mobile app penetration testing Deliver actionable security guidance to project teams Lead Security Development Lifecycle efforts, coordinating other security architects, security champions and project teams in performing secure architecture reviews, secure code reviews, threat models and penetration testing through the software development lifecycle; Keeps abreast of security industry best practices and OWASP recommendations utilizing knowledge to contribute to remediation efforts across the platform, as well as security policies and procedures; Actively identify and collaborate with security champions in the development and engineering organization to scale security expertise and awareness. Write and oversee the creation of application security standards and guidelines and assist in the implementation of these standards across the organization Deep experience working with compliance and regulatory frameworks such as PCI-DSS, HIPAA/HITRUST, SO