Application Security Analyst

Are you passionate about secure code and finding vulnerabilities before they become threats?

Our client, an international IT services and custom software development company, is looking for an Application Security Analyst to support a global telecommunications project in Valencia.

You will collaborate with established Application Security teams, review web application code, and help developers build secure solutions. This role requires hands-on application security experience, particularly with Java, alongside knowledge of C++ and/or C#.

Your responsibilities

• Review business requirements and software architecture to identify security risks.
• Perform manual source code reviews, primarily in Java, with additional C++ and/or C# codebases.
• Conduct static and dynamic application security testing (SAST and DAST).
• Perform penetration testing and manually validate application vulnerabilities.
• Work closely with development teams to recommend, explain, and verify effective remediation.
• Support security throughout the application development lifecycle.

What you bring

• A bachelor’s degree in Cybersecurity, IT, Mathematics, or a related discipline.
• At least 3 years of professional experience in application security.
• Proven experience in secure code review, penetration testing, and vulnerability assessment.
• Strong understanding of Java and experience with C++ and/or C#.
• Practical knowledge of the OWASP Top 10, particularly SQL injection and Cross-Site Scripting (XSS).
• The ability to explain vulnerabilities, their impact, and how to prevent or mitigate them.
• Solid knowledge of information security and data protection principles.
• Excellent written and spoken English.
• The ability to work independently and collaborate effectively with technical teams.
• Willingness to relocate to Valencia and work fully from the office.

What’s on offer

• An international telecommunications project with challenging application security work.
• Access to training programs, courses, and certifications.
• Relocation support, including sponsored flights, one week of hotel accommodation, and assistance from the HR team.

Contract and compensation

• B2B engagement, ideally through an entity established in Spain.
• Indicative compensation: USD 4,000-6,000 per month before tax, depending on experience and agreed terms.
• 40 hours per week, fully on-site in Valencia.
• Billing based on actual hours worked.
• 20 days of unpaid leave per year, with flexibility subject to agreement.
• No paid public holidays.

Selection process

The process includes an internal interview and a client interview, with a technical assessment covering secure code review, vulnerability identification, and remediation.

• A bachelor’s degree in Cybersecurity, IT, Mathematics, or a related discipline.
• At least 3 years of professional experience in application security.
• Proven experience in secure code review, penetration testing, and vulnerability assessment.
• Strong understanding of Java and experience with C++ and/or C#.
• Practical knowledge of the OWASP Top 10, particularly SQL injection and Cross-Site Scripting (XSS).
• The ability to explain vulnerabilities, their impact, and how to prevent or mitigate them.
• Solid knowledge of information security and data protection principles.
• Excellent written and spoken English.
• The ability to work independently and collaborate effectively with technical teams.
• Willingness to relocate to Valencia and work fully from the office.

• An international telecommunications project with challenging application security work.
• Access to training programs, courses, and certifications.
• Relocation support, including sponsored flights, one week of hotel accommodation, and assistance from the HR team.

Contract and compensation

• B2B engagement, ideally through an entity established in Spain.
• Indicative compensation: USD 4,000-6,000 per month before tax, depending on experience and agreed terms.
• 40 hours per week, fully on-site in Valencia.
• Billing based on actual hours worked.
• 20 days of unpaid leave per year, with flexibility subject to agreement.
• No paid public holidays.

Selection process

The process includes an internal interview and a client interview, with a technical assessment covering secure code review, vulnerability identification, and remediation.