Application Security Architect

About the role

As an Application Security Architect at Johnson Controls, you will embed security and privacy throughout the product lifecycle for intelligent buildings, connected products, and smart cities. You will act as a trusted security advisor, guiding engineering and product teams on secure software development and security‑by‑design practices.

Key responsibilities

• Partner with engineering, product and business teams to shape security strategy and lead risk assessments.
• Guide development teams on secure coding, threat modeling, security architecture and secure SDLC activities.
• Conduct architecture reviews, code reviews, security testing, vulnerability management and remediation planning.
• Translate regulatory, customer and cybersecurity requirements into practical security controls.
• Collaborate with security champions, architects and product leaders to balance security, usability and business objectives.

Required profile

• Minimum 3 years of experience in cybersecurity, governance, risk, compliance or product security.
• Experience with NIST 800‑53, ISO 27001 or SOC 2 frameworks.
• Strong stakeholder management and ability to build trusted relationships.
• Bachelor’s degree in Cybersecurity, Computer Science, Engineering or related field (preferred).
• Professional certifications such as CISSP, GSEC, Security+ (preferred).

Required skills

• Secure software development, threat modeling and security‑by‑design principles.
• Knowledge of compliance frameworks: ISA/IEC 62443, GDPR, EU CRA.
• Experience with AI security, Operational Technology (OT), IoT ecosystems.
• Familiarity with tools such as SD Elements, FiniteState, ArmorCode, jFrog and Jira.