Application Security Analyst

Application Security & Testing

• Perform security testing: SAST, DAST, IAST, mobile security, and dynamic testing
• Analyze vulnerabilities and recommend secure coding fixes
• Demonstrate vulnerabilities to development teams
• Drive remediation efforts to closure

DevSecOps & Tooling

• Work within CI/CD pipelines using tools such as:
• Jenkins, GitLab, GitHub Actions, TeamCity
• Checkmarx, GitHub Advanced Security, Burp Suite
• Integrate security controls into development workflows

WAF & Security Controls

• Lead Web Application Firewall (WAF) deployment for new and existing apps
• Implement application security policies, controls, and standards

Collaboration & Enablement

• Partner with development, platform, and supplier teams
• Provide clear remediation guidance
• Train teams on secure coding and application security practices
• Develop training materials

Assessment & Reporting

• Conduct security assessments using standard tools
• Track and report:
• Risks
• Milestones
• Deliverables
• Status updates
• Recommend strategies based on application risk posture

Bachelor's degree in Computer Science, Information Technology, or related field

3+ years of hands-on experience in application security, security testing, and DevSecOps

Strong understanding of:

• Application architectures (web, mobile, APIs)
• Software development methodologies (Agile, SDLC)
• Modern programming languages (Java, C#, Python)

Experience performing and interpreting results from:

• SAST, DAST, IAST, SCA, and mobile security testing tools

Hands-on experience with secure code review in common languages (Java, C#, Python preferred)

Prior background in application development, including:

• Compiled code
• Web applications / services
• Mobile app development

Knowledge of security frameworks and standards:

• NIST, ISO 27001
• NIST SSDF or similar secure development frameworks

Strong understanding of:

• OWASP Top 10 vulnerabilities and mitigation techniques
• Common attack vectors (web exploits, DDoS, bot attacks)

Experience with WAF technologies:

• Akamai, Cloudflare, AWS WAF, Azure Front Door

Familiarity with cloud platforms and modern environments:

• AWS, Azure, GCP
• Containers (Docker, Kubernetes)

Working knowledge of:

• Programming/scripting: Java, JavaScript, SQL, HTML
• Scripting languages (Python, Bash preferred)

Strong analytical, problem-solving, and communication skills

• Ability to explain technical risks to non-technical audiences
• Experience writing security reports and documentation

Ability to work independently and cross-functionally

Preferred Qualifications:

• Industry certifications:
• GIAC GWEB
• ISC2 CSSLP
• EC-Council CASE
• Or equivalent AppSec certifications

Skills: Agile Programming Methodologies, Analysis Skills, Applications Security, Cloud Computing, Code Reviews, Communication Skills, Computer Science, Computer Security, Continuous Deployment/Delivery, Continuous Integration, Cross-Functional, Firewalls, HTML (HyperText Markup Language), ISO (International Organization for Standardization), Information Technology & Information Systems, Internet Application, Internet Security, Java, JavaScript, Machine Tool, Microsoft C# (C Sharp), Mobile Applications Development, Problem Solving Skills, Programming Languages, Python Programming/Scripting Language, SQL (Structured Query Language), Scripting (Scripting Languages), Secure Coding, Security Analysis, Software Development, Software Development Lifecycle (SDLC), Test Tools, Testing, U.S. National Institute of Standards and Technology (NIST)