ACLU
About The Job
The ACLU seeks applicants for the full‑time position of
Application Security Architect
in the Information Security Department of the ACLU’s National office in New York, NY.
This hybrid role requires in‑office presence two (2) days per week or eight (8) days per month.
The Application Security Architect will define how secure applications are designed, integrated, and maintained across the ACLU’s cloud, SaaS, and hybrid environments. You’ll lead efforts to embed security throughout the software development lifecycle (SDLC), own our internal Security Architecture Review (SAR) process, and guide secure integration practices for highly customized platforms and third‑party applications critical to our civil liberties mission.
The role collaborates closely with product, platform, engineering, DevOps, IT, and affiliates to assess and mitigate risks associated with application design, data flows, integrations, and third‑party software usage. You’ll help set and enforce security standards, perform hands‑on threat modeling, define secure development and deployment patterns, and directly support high‑impact systems involving donor data, legal case workflows, and internal operational apps.
This hands‑on technical leadership role will own and drive the ACLU’s application security efforts across both internally developed and externally adopted applications.
Position is part of a collective bargaining unit represented by ACLU Staff United (ASU).
What You’ll Do Reporting to the Director, Security Architecture & Engineering, the Application Security Architect will define and drive the ACLU’s application security roadmap from code to cloud and everything in between.
YOUR DAY TO DAY
Lead the ACLU’s Application Security Program, owning the InfoSec SDLC strategy and continuous improvement of application‑layer security across cross‑functional teams.
Own the Security Architecture Review (SAR) process, including intake, risk evaluation, documentation, and partner engagement.
Perform and guide threat modeling for new applications, integrations, and high‑risk workflows—including financial systems, legal platforms, and supporter/donor tools.
Define secure design patterns for authentication (OAuth/OIDC), secrets management, API authorization, session handling, and data flow protections across internal and third‑party systems.
Evaluate, deploy, and maintain AppSec tooling such as SAST, DAST, SCA, API security tools, and secrets detection platforms, based on risk and developer stack alignment.
Partner with stakeholders to assess internal cloud apps, low‑code tools, and internal workflow automations for security risks.
Oversee application‑layer vulnerability triage, analysis, and escalation—including issues from internal testing, coordinated disclosure, and external penetration testing.
Collaborate with platform owners of high‑risk SaaS platforms to validate that application‑level security controls—authZ, audit logging, IP allowlists, token lifetimes, etc.—are in place and enforced.
Ensure application‑layer security extends across data ecosystems, including ETL and reverse ETL pipelines, data warehouse platforms (e.g., Redshift, Snowflake), and high‑risk integrations that move or transform sensitive donor, legal, or supporter data between internal systems and external SaaS tools.
Identify and reduce emerging application‑layer risks related to AI adoption, including prompt injection, model abuse, insecure integrations with LLM APIs, and exposure of sensitive data through AI‑powered features or automations.
FUTURE ACLU'ERS WILL
Be committed to advancing the mission of the ACLU.
Center and embed the principles of equity, inclusion and belonging in their work by demonstrating commitment to diversity with an approach that respects and values multiple perspectives.
Be committed to work collaboratively and respectfully toward resolving obstacles and conflicts.
What You’ll Bring
Extensive experience in application or product security, secure software development, or DevSecOps architecture.
Practical experience designing and implementing secure SDLC, AppSec testing workflows, or automated CI/CD security gates.
Deep understanding of common software vulnerabilities (e.g., OWASP Top 10), secure coding practices, and threat modeling methodologies.
Familiarity with GitHub Actions, modern SaaS stacks, and secure API design principles.
Familiarity with CMS tooling (e.g., Drupal, WordPress), cloud computing platforms (e.g., GCP, Azure, AWS), and containerization environments (e.g., Kubernetes, Docker, ECS).
Experience securing data pipelines and warehouse environments, with a focus on protecting structured data.
Experience partnering directly with developers and product teams to influence secure outcomes.
Excellent communication skills, especially when translating technical issues into business risk language.
Compensation The ACLU is committed to equity, transparency, and clarity in pay. The annual salary for this position is
$161,123 (Level – E)
for a role based in New York, NY. Salaries are subject to regional pay adjustment if authorized to work outside the listed location.
For details on our pay structure, visit
pay structure PDF .
Why the ACLU For over 100 years, the ACLU has worked to defend and preserve the individual rights and liberties guaranteed by the Constitution and laws of the United States. Whether it’s ending mass incarceration, achieving full equality for the LGBTQ+ community, establishing new privacy protections for our digital age, or preserving the right to vote or the right to have an abortion, the ACLU takes up the toughest civil liberties cases and issues to defend all people.
Benefits
Generous paid time‑off policy.
Comprehensive healthcare benefits (including medical, dental, vision coverage, parental leave, gender affirming care & fertility treatment).
401(k) plan with employer match.
Professional development funds and internal programs.
Our Commitment to Accessibility, Equity, Diversity & Inclusion Accessibility, equity, diversity and inclusion are core values of the ACLU and central to our work. We are a community committed to learning and growth, humility and grace, transparency and accountability. We believe in a collective responsibility to create a culture of belonging for all people within our organization.
We strongly encourage applications from all qualified individuals without regard to race, color, religion, gender, sexual orientation, age, national origin, marital status, citizenship, disability, veteran status, or any other characteristic protected by applicable law.
The ACLU is committed to providing reasonable accommodation to individuals with disabilities. If you are a qualified individual with a disability and need assistance applying online, please email benefits.hrdept@aclu.org. If you are selected for an interview, you will receive additional information regarding how to request an accommodation for the interview process.
#J-18808-Ljbffr
Application Security Architect
in the Information Security Department of the ACLU’s National office in New York, NY.
This hybrid role requires in‑office presence two (2) days per week or eight (8) days per month.
The Application Security Architect will define how secure applications are designed, integrated, and maintained across the ACLU’s cloud, SaaS, and hybrid environments. You’ll lead efforts to embed security throughout the software development lifecycle (SDLC), own our internal Security Architecture Review (SAR) process, and guide secure integration practices for highly customized platforms and third‑party applications critical to our civil liberties mission.
The role collaborates closely with product, platform, engineering, DevOps, IT, and affiliates to assess and mitigate risks associated with application design, data flows, integrations, and third‑party software usage. You’ll help set and enforce security standards, perform hands‑on threat modeling, define secure development and deployment patterns, and directly support high‑impact systems involving donor data, legal case workflows, and internal operational apps.
This hands‑on technical leadership role will own and drive the ACLU’s application security efforts across both internally developed and externally adopted applications.
Position is part of a collective bargaining unit represented by ACLU Staff United (ASU).
What You’ll Do Reporting to the Director, Security Architecture & Engineering, the Application Security Architect will define and drive the ACLU’s application security roadmap from code to cloud and everything in between.
YOUR DAY TO DAY
Lead the ACLU’s Application Security Program, owning the InfoSec SDLC strategy and continuous improvement of application‑layer security across cross‑functional teams.
Own the Security Architecture Review (SAR) process, including intake, risk evaluation, documentation, and partner engagement.
Perform and guide threat modeling for new applications, integrations, and high‑risk workflows—including financial systems, legal platforms, and supporter/donor tools.
Define secure design patterns for authentication (OAuth/OIDC), secrets management, API authorization, session handling, and data flow protections across internal and third‑party systems.
Evaluate, deploy, and maintain AppSec tooling such as SAST, DAST, SCA, API security tools, and secrets detection platforms, based on risk and developer stack alignment.
Partner with stakeholders to assess internal cloud apps, low‑code tools, and internal workflow automations for security risks.
Oversee application‑layer vulnerability triage, analysis, and escalation—including issues from internal testing, coordinated disclosure, and external penetration testing.
Collaborate with platform owners of high‑risk SaaS platforms to validate that application‑level security controls—authZ, audit logging, IP allowlists, token lifetimes, etc.—are in place and enforced.
Ensure application‑layer security extends across data ecosystems, including ETL and reverse ETL pipelines, data warehouse platforms (e.g., Redshift, Snowflake), and high‑risk integrations that move or transform sensitive donor, legal, or supporter data between internal systems and external SaaS tools.
Identify and reduce emerging application‑layer risks related to AI adoption, including prompt injection, model abuse, insecure integrations with LLM APIs, and exposure of sensitive data through AI‑powered features or automations.
FUTURE ACLU'ERS WILL
Be committed to advancing the mission of the ACLU.
Center and embed the principles of equity, inclusion and belonging in their work by demonstrating commitment to diversity with an approach that respects and values multiple perspectives.
Be committed to work collaboratively and respectfully toward resolving obstacles and conflicts.
What You’ll Bring
Extensive experience in application or product security, secure software development, or DevSecOps architecture.
Practical experience designing and implementing secure SDLC, AppSec testing workflows, or automated CI/CD security gates.
Deep understanding of common software vulnerabilities (e.g., OWASP Top 10), secure coding practices, and threat modeling methodologies.
Familiarity with GitHub Actions, modern SaaS stacks, and secure API design principles.
Familiarity with CMS tooling (e.g., Drupal, WordPress), cloud computing platforms (e.g., GCP, Azure, AWS), and containerization environments (e.g., Kubernetes, Docker, ECS).
Experience securing data pipelines and warehouse environments, with a focus on protecting structured data.
Experience partnering directly with developers and product teams to influence secure outcomes.
Excellent communication skills, especially when translating technical issues into business risk language.
Compensation The ACLU is committed to equity, transparency, and clarity in pay. The annual salary for this position is
$161,123 (Level – E)
for a role based in New York, NY. Salaries are subject to regional pay adjustment if authorized to work outside the listed location.
For details on our pay structure, visit
pay structure PDF .
Why the ACLU For over 100 years, the ACLU has worked to defend and preserve the individual rights and liberties guaranteed by the Constitution and laws of the United States. Whether it’s ending mass incarceration, achieving full equality for the LGBTQ+ community, establishing new privacy protections for our digital age, or preserving the right to vote or the right to have an abortion, the ACLU takes up the toughest civil liberties cases and issues to defend all people.
Benefits
Generous paid time‑off policy.
Comprehensive healthcare benefits (including medical, dental, vision coverage, parental leave, gender affirming care & fertility treatment).
401(k) plan with employer match.
Professional development funds and internal programs.
Our Commitment to Accessibility, Equity, Diversity & Inclusion Accessibility, equity, diversity and inclusion are core values of the ACLU and central to our work. We are a community committed to learning and growth, humility and grace, transparency and accountability. We believe in a collective responsibility to create a culture of belonging for all people within our organization.
We strongly encourage applications from all qualified individuals without regard to race, color, religion, gender, sexual orientation, age, national origin, marital status, citizenship, disability, veteran status, or any other characteristic protected by applicable law.
The ACLU is committed to providing reasonable accommodation to individuals with disabilities. If you are a qualified individual with a disability and need assistance applying online, please email benefits.hrdept@aclu.org. If you are selected for an interview, you will receive additional information regarding how to request an accommodation for the interview process.
#J-18808-Ljbffr