Analyst Lead, Cybersecurity

FIS Global • Atlanta, GA

3d

About The Position

As a hands-on technical leader in FIS Cybersecurity’s Attack Surface Management function, the Senior Application Security Engineer identifies, assesses and reduces security risk across web, API, mobile, cloud-native and AI-enabled applications supporting global financial services. The role conducts deep technical security assessments, shapes application security policies and encryption standards, and helps engineering teams adopt secure development practices. As a subject matter expert, the role identifies complex vulnerabilities, explains their business impact and helps teams remediate them at scale.

The position owns and improves the application attack surface management program; performs application, API, mobile, cloud, infrastructure-as-code and container security assessments; and integrates security testing into development workflows. It also supports PCI DSS compliance, audits and evidence collection, partners with engineering and product teams on remediation and design decisions, and mentors junior team members.

FIS offers a modern, international work environment with a dedicated team, professional education and personal development opportunities, challenging work in financial services and technology, and a collaborative environment built on flexibility and respect.

Requirements

• At least 9 years of experience in software development and application security, including at least 5 years of hands-on experience in SAST, DAST, SCA, API security, manual secure code review, threat modeling and container security.
• Experience conducting application, API and mobile security assessments using tools such as Burp Suite Professional, Checkmarx, OWASP ZAP, Postman, AppScan, WebInspect, Fortify, Veracode or Semgrep.
• Hands-on Android and iOS penetration testing experience using tools such as MobSF, Frida, Objection, Jadx, apktool, Hopper/Ghidra and Xcode/Android Studio, and strong understanding of OWASP MASVS and MASTG.
• Strong manual source code review skills in at least two major programming languages, including the ability to identify complex and logic-based vulnerabilities that automated tools may miss.
• Expert knowledge of the OWASP Top 10, OWASP API Security Top 10, SANS/CWE Top 25 and common attack techniques, including exploiting, validating and remediating vulnerabilities.
• Hands-on experience securing infrastructure-as-code and containerized environments with tools such as Checkov, tfsec, KICS, Trivy, Grype, Snyk Container or Prisma Cloud, and working knowledge of Docker and Kubernetes.
• Strong knowledge of cryptography and data protection, including encryption standards, key management, PKI, TLS and secure secrets handling, plus experience writing or reviewing encryption policies.
• Experience integrating security testing into CI/CD pipelines such as Jenkins, GitHub Actions, GitLab CI or Azure DevOps.
• Working knowledge of PCI DSS requirements as they apply to secure software development and application security.
• Excellent communication skills, including the ability to explain technical risk to engineers and leadership and build effective working relationships with colleagues and clients.

Nice To Haves

• Experience with SCA and supply chain security tools such as Checkmarx, Black Duck, Snyk or Dependency-Track, and with SBOM standards.
• Experience assessing AI/LLM-enabled applications or using AI and machine learning to improve security testing and triage.
• Experience with external attack surface management platforms and asset discovery techniques.
• Familiarity with cloud security on AWS, Azure or GCP, including identity and access management, network security and cloud-native security services.
• Experience with policy-as-code frameworks such as OPA/Rego or Sentinel.
• Knowledge of malicious code analysis, reverse engineering and advanced exploitation techniques.
• Broad working knowledge of identity and access management, privileged access, and threat and vulnerability management.
• Relevant certifications such as OSCP, OSWE, GWAPT, GMOB, eMAPT, CSSLP, CISSP, CKS or equivalent.
• Experience working in financial services or other highly regulated environments.

Responsibilities

• Own and continuously improve the application attack surface management program, including discovering, inventorying and risk-ranking internet-facing applications, APIs, mobile apps and cloud assets, and identifying shadow IT and unmanaged exposure.
• Perform and oversee SAST and DAST, tune rulesets, triage findings, reduce false positives and integrate scanning into CI/CD pipelines.
• Conduct manual source code reviews across multiple programming languages to identify complex and logic-based vulnerabilities.
• Lead API security assessments across REST, GraphQL, gRPC and SOAP services, including authentication, authorization and OWASP API Security Top 10 risks.
• Facilitate threat modeling using approaches such as STRIDE, PASTA and attack trees; create data flow diagrams and trust boundary analyses and translate findings into security requirements and design changes.
• Perform Android and iOS penetration testing, including static and dynamic analysis, reverse engineering, runtime instrumentation and assessment of mobile security controls and data handling.
• Run software composition analysis to identify vulnerable and non-compliant open-source components; assess license risk and coordinate dependency remediation and supply chain security practices.
• Assess infrastructure-as-code templates for misconfigurations and policy violations, and enforce guardrails through policy-as-code.
• Secure containerized and orchestrated workloads by scanning and hardening images, reviewing Kubernetes configurations, signing images, and securing registries and runtimes.
• Define, review and maintain encryption and cryptography policies, including TLS, key management and rotation, HSM and KMS usage, approved algorithms, data protection, and alignment with relevant standards and guidance.
• Review and update application security policies, standards and secure SDLC procedures to reflect emerging threats, regulatory changes and industry practices.
• Assess AI- and LLM-enabled applications for security risks and use AI and automation to support vulnerability discovery, triage and remediation guidance.
• Support PCI DSS compliance by mapping application security controls to requirements, particularly Requirement 6 and payment page script integrity; support audits and evidence collection.
• Partner with development, DevOps, cloud and product teams to explain vulnerabilities, validate fixes and embed security throughout the development lifecycle; provide risk ratings and remediation guidance.
• Mentor junior team members, contribute to security tooling and automation, and represent application security in architecture and design reviews.

Benefits

• Professional education and personal development opportunities.
• Challenging work in financial services and technology.
• A collaborative work environment built on flexibility and respect.
• Varied work that supports growth in product, functional, domain and leadership skills.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed