Full job description

What you will do

At Johnson Controls, you'll help secure the technologies behind intelligent buildings, connected products, and smart cities. As an Application Security Architect, you'll partner with engineering, product, and business teams to embed security and privacy throughout the product lifecycle, shape security strategy, lead risk assessments, and drive continuous improvements that strengthen cybersecurity resilience and customer trust.

Working as a trusted security advisor, you'll guide teams on secure software development, threat modeling, security architecture, and security-by-design practices across cloud, mobile, embedded, and connected products. You'll lead key security activities including architecture reviews, security testing, vulnerability management, and compliance support while translating security requirements into practical solutions that help teams deliver secure, resilient products.

How you will do it

Act as a trusted security advisor throughout the software development lifecycle.
Guide development teams on secure coding, threat modeling, security architecture, and security-by-design principles.
Lead secure SDLC activities, including security requirements definition, architecture reviews, code reviews, security testing, and remediation planning.
Translate regulatory, customer, and cybersecurity requirements into practical security controls and development practices.
Collaborate with security champions, architects, engineers, and product leaders to balance security, usability, and business objectives.
Partner with teams across cloud, mobile, embedded, and connected product environments to address evolving security challenges.
Stay current with emerging threats, vulnerabilities, and industry best practices, sharing knowledge and recommendations across the organization.

What we look for

Required

Minimum 3 years in cybersecurity, governance, risk, compliance, product security, or a related security function.
Experience working with cybersecurity and compliance frameworks NIST 800-53 and also ISO 27001 or SOC 2.
Experience evaluating cybersecurity risks and implementing or recommending appropriate security controls.