Application Security Analyst II

Job Summary

The Application Security Analyst II supports the organization's application security program by identifying, assessing, and helping remediate security risks throughout the software development lifecycle. This individual partners with application development, engineering, architecture, infrastructure, risk, privacy, compliance, and cyber security teams to promote secure design and development practices.

The position performs application security assessments, supports security testing and vulnerability management, documents security requirements, and helps integrate security controls into development and deployment processes.

What You Will Do

• Perform application security assessments for new and existing applications, APIs, integrations, and supporting services.
• Conduct or coordinate application security testing, including static application security testing (SAST), dynamic application security testing (DAST), software composition analysis (SCA), API security testing, and manual validation, as appropriate.
• Analyze application security findings, validate risk and impact, reduce false positives, and partner with development teams to prioritize and remediate vulnerabilities.
• Participate in application threat modeling and secure design reviews to identify risks and recommend practical security controls before deployment.
• Define, document, communicate, and maintain application security requirements, standards, procedures, and supporting guidance.
• Partner with development and engineering teams to integrate security checks and guardrails into source code management and CI/CD pipelines.
• Provide consultative support on secure coding practices, common application vulnerabilities, authentication, authorization, session management, secrets management, data protection, and API security.
• Track application security risks, remediation plans, exceptions, and metrics; escalate material risks or overdue remediation through established governance processes.
• Support the evaluation, implementation, administration, and continuous improvement of application security tools and processes.
• Contribute to security awareness and enablement by developing guidance and sharing actionable application security recommendations with technical teams.
• Participate in relevant project, change, architecture, and security governance reviews, as needed.
• Maintain awareness of emerging application security threats, vulnerabilities, attack techniques, and industry practices.

Role Expectations and Core Competencies

• Demonstrates the ability to collaborate effectively across teams, incorporate diverse perspectives, and contribute to high-quality results and the successful completion of shared objectives.
• Demonstrates a strong customer orientation by considering customer needs and perspectives in decision-making, building effective relationships, and developing solutions and processes that support a positive customer experience.
• Demonstrates the ability to define problems, analyze and interpret information, anticipate potential obstacles, and develop effective solutions. Uses sound judgment and data to make informed decisions and communicates findings clearly and concisely.
• Demonstrates an inherent passion for information security and service excellence.
• Communicates clearly, accurately, and effectively in verbal and written formats, adapting information as appropriate for technical and non-technical audiences.
• Demonstrates self-motivation and the ability to work independently with general direction, effectively prioritizing competing responsibilities, managing multiple deadlines, and driving assigned work through successful completion.

Who You Are

• Bachelor's degree in Computer Science, Computer Engineering, Information Technology, Cyber Security, or a related technical field. A minimum of four (4) years of relevant industry experience may be considered in lieu of a formal degree.
• Minimum of three (3) years of information technology experience, including at least one (1) year of experience in information security, application development, application security, or a closely related discipline.
• Working knowledge of secure software development lifecycle practices and the ability to apply security requirements within Agile or other development methodologies.
• Working knowledge of common application and API vulnerabilities, including the OWASP Top 10, and practical approaches for prevention and remediation.
• Experience with one or more application security testing approaches or technologies, such as SAST, DAST, SCA, API security testing, secrets scanning, or container security scanning.
• Ability to review and interpret application security findings, assess business and technical risk, and communicate clear remediation guidance to development and engineering teams.
• Understanding of secure coding concepts and application security controls, including authentication, authorization, input validation, session management, encryption, secrets management, logging, and error handling.
• Understanding of web technologies, APIs, cloud-hosted applications, source code management, and CI/CD concepts.
• Familiarity with vulnerability management, risk acceptance, exception handling, and remediation tracking processes.
• Strong analytical, problem-solving, documentation, and communication skills.

What Will Make You Stand Out

• Hands-on experience with enterprise application security tools and developer security workflows.
• Experience integrating security testing into CI/CD pipelines and development platforms.
• Familiarity with one or more programming or scripting languages and the ability to understand application code.
• Familiarity with cloud-native application architectures, containers, microservices, and infrastructure as code.
• Application security or security-related certifications, such as CSSLP, GIAC, CISSP, Security+, or comparable credentials is a plus