Maintain reusable application security patterns, architecture decision records, and guidance for identity, tenant isolation, input and file handling, cryptography, secrets, logging, PHI workflows, APIs, OAuth 2.0, OpenID Connect, and service communications.
Influence the Secure SDLC and AIDLC through architecture gates, threat-modeling criteria, secure coding and AI guardrails, testing requirements, and risk-based release criteria. Address prompt injection, data leakage, insecure tool or output use, excessive agency, authorization bypass, and improper use of PHI, source code, or credentials.
Define validation requirements for AI-generated code and AI-enabled applications, including developer review, provenance and licensing, secrets and dependency scanning, SAST, SCA, DAST, API, container, infrastructure-as-code, and pre-production testing; analysts execute routine reviews.
Provide architectural guidance and escalation for testing, vulnerability management, supply-chain risk, penetration testing, and high-risk findings. Present design recommendations, tradeoffs, and remediation strategies to engineering, product, security leadership, and governance forums.
Provide senior architectural review to Nepal application and cloud security personnel for complex reviews, threat models, AI assessments, risk decisions, and systemic findings without duplicating analyst work. Align Cedar Gate patterns with IQVIA security architecture requirements.
Required Experience and Qualifications
6 or more years of progressive experience in application security, software engineering, product security, cloud security, security engineering, or application security architecture; 6–8 years of directly relevant experience is preferred.
Experience reviewing new and existing application architectures, conducting threat modeling, documenting sensitive data flows and trust boundaries, and translating threats into practical requirements; strong knowledge of application and API security, multi-tenant SaaS, identity, cryptography, secrets, logging, supply-chain risk, and PHI processing.
Experience influencing Secure SDLC and AIDLC practices, defining risk-based review and release criteria, and embedding security into CI/CD. Knowledge of SAST, SCA, DAST, API, secrets, container, infrastructure-as-code, and penetration testing; experience evaluating generated code, AI assistants, agents, LLM integrations, and sensitive-data handling is required.
Working knowledge of application-facing AWS architecture and relevant standards, including OWASP ASVS, OWASP Top 10, OWASP API Security Top 10, OWASP SAMM, OWASP LLM guidance, NIST Secure Software Development Framework, MITRE CWE, HIPAA, HITRUST, SOC 2, CIS, and NIST requirements.
Strong analytical and communication skills; ability to work predominantly during U.S. business hours with teams in the United States, Nepal, Portugal, and other IQVIA locations; fluent English; bachelor’s degree in a related field or equivalent practical experience.
Preferred Experience
Healthcare SaaS, PHI exchange, analytics, managed file transfer or sFTP, and multi-tenant platforms.
Hands-on development or DevOps experience; integration of an acquired business into enterprise AppSec practices
CSSLP, CISSP, CCSP, GIAC Web Application Defender, or relevant AWS certification.
IQVIA is a leading global provider of clinical research services, commercial insights, and healthcare intelligence to the life sciences and healthcare industries. We create intelligent connections to accelerate the development and commercialization of innovative medical treatments to help improve patient outcomes and population health worldwide. Learn more at https://jobs.iqvia.com.
IQVIA is committed to integrity in our hiring process and maintains a zero tolerance policy for candidate fraud. All information and credentials submitted in your application must be truthful and complete. Any false statements, misrepresentations, or material omissions during the recruitment process will result in immediate disqualification of your application, or termination of employment if discovered later, in accordance with applicable law. We appreciate your honesty and professionalism.
At IQVIA, we believe that diversity, inclusion, and belonging empower our mission to accelerate innovation for a healthier world. We create a culture of belonging by valuing the perspectives of all talented employees worldwide and providing them with the opportunity to power smarter healthcare for everyone, everywhere. When our talented employees bring their authentic selves and their diverse experiences to work, they enable us to accomplish extraordinary things. Multifaceted thought processes spark innovation. Multi-talented collaboration harnesses innovation to deliver superior outcomes. Likewise, as part of this culture, IQVIA is committed to ensuring effective equality between women and men, integrating it as a strategic principle in its corporate and human resources policies.
