Analyst Lead, Cybersecurity

FIS • Atlanta, GA

3d

About The Position

The role is a hands-on technical leadership position in FIS Cybersecurity’s Attack Surface Management function. It focuses on identifying, assessing, and reducing security risk across web, API, mobile, cloud-native, and AI-enabled applications supporting global financial services. The position conducts and oversees technical security assessments, including SAST, DAST, SCA, manual source code review, threat modeling, IaC and container security, and Android and iOS penetration testing.

The role also shapes security policies, encryption standards, and secure development practices used by engineering teams across FIS. As a subject matter expert, the successful candidate identifies complex vulnerabilities, explains their business impact, and helps development teams remediate issues at scale. The position partners with development, DevOps, cloud, and product teams, mentors junior team members, contributes to security tooling and automation, and represents application security in architecture and design reviews.

Requirements

• At least 9 years of experience in software development and application security, including at least 5 years of hands-on work in SAST, DAST, SCA, API security, manual secure code review, threat modeling, and container security.
• Proven experience conducting application, API, and mobile security assessments using tools such as Burp Suite Professional, Checkmarx, OWASP ZAP, Postman, AppScan, WebInspect, Fortify, Veracode, or Semgrep.
• Hands-on Android and iOS penetration testing experience using tools such as MobSF, Frida, Objection, Jadx, apktool, Hopper/Ghidra, and Xcode/Android Studio, with a strong understanding of OWASP MASVS and MASTG.
• Strong manual source code review skills in at least two major programming languages, including the ability to identify complex and logic-based vulnerabilities that automated tools miss.
• Expert knowledge of the OWASP Top 10, OWASP API Security Top 10, SANS/CWE Top 25, and common attack techniques, including exploitation, validation, and remediation.
• Hands-on experience securing IaC and containerized environments using tools such as Checkov, tfsec, KICS, Trivy, Grype, Snyk Container, or Prisma Cloud, and working knowledge of Docker and Kubernetes.
• Strong knowledge of cryptography and data protection, including encryption standards, key management, PKI, TLS, and secure secrets handling, plus experience writing or reviewing encryption policies.
• Experience integrating security testing into CI/CD pipelines such as Jenkins, GitHub Actions, GitLab CI, or Azure DevOps.
• Working knowledge of PCI DSS requirements as they apply to secure software development and application security.
• Excellent communication skills, including the ability to explain technical risk to engineers and leadership and build effective working relationships with colleagues and clients.

Nice To Haves

• Experience with SCA and supply chain security tools such as Checkmarx, Black Duck, Snyk, or Dependency-Track, and with SBOM standards.
• Experience assessing AI/LLM-enabled applications or using AI and machine learning to improve security testing and triage.
• Experience with external attack surface management platforms and asset discovery techniques.
• Familiarity with cloud security on AWS, Azure, or GCP, including identity and access management, network security, and cloud-native security services.
• Experience with policy-as-code frameworks such as OPA/Rego or Sentinel.
• Knowledge of malicious code analysis, reverse engineering, and advanced exploitation techniques.
• Broad working knowledge of identity and access management, privileged access, and threat and vulnerability management.
• Relevant certifications such as OSCP, OSWE, GWAPT, GMOB, eMAPT, CSSLP, CISSP, CKS, or equivalent.
• Experience working in financial services or other highly regulated environments.

Responsibilities

• Own and continuously improve the application attack surface management program, including discovering, inventorying, and risk-ranking internet-facing applications, APIs, mobile apps, and cloud assets, and identifying shadow IT and unmanaged exposure.
• Perform and oversee SAST and DAST, tune rulesets, triage findings, reduce false positives, and integrate scanning into CI/CD pipelines.
• Conduct in-depth manual source code reviews across multiple programming languages to identify business logic flaws and other security vulnerabilities.
• Lead API security assessments for REST, GraphQL, gRPC, and SOAP services, covering authentication, authorization, common API vulnerabilities, and OWASP API Security Top 10 alignment.
• Facilitate threat modeling using methodologies such as STRIDE, PASTA, or attack trees; produce data flow diagrams and trust boundary analyses; and translate findings into security requirements and design changes.
• Perform Android and iOS application penetration testing, including static and dynamic analysis, reverse engineering, runtime instrumentation, and assessments of application protections, data storage, and inter-process communication.
• Run software composition analysis to identify vulnerable and non-compliant open-source components, assess license risk, and coordinate dependency remediation and supply chain security practices.
• Assess IaC templates for misconfigurations and policy violations, and enforce guardrails through policy-as-code.
• Secure containerized and orchestrated workloads by scanning and hardening images, reviewing Kubernetes configurations, signing images, and securing registries and runtimes.
• Define, review, and maintain encryption and cryptography policies covering TLS, key management and rotation, HSM and KMS usage, approved algorithms, and data protection.
• Review and update application security policies, standards, and secure SDLC procedures to reflect emerging threats, regulatory changes, and industry practices.
• Assess AI- and LLM-enabled applications for security risks and use AI and automation to accelerate vulnerability discovery, triage, and remediation guidance.
• Support PCI DSS compliance by mapping application security controls to relevant requirements, including Requirement 6 and payment page script integrity, and assist with audits and evidence collection.
• Partner with development, DevOps, cloud, and product teams to explain vulnerabilities, validate fixes, and embed security into the development lifecycle; provide risk ratings and remediation guidance.
• Mentor junior team members, contribute to security tooling and automation, and represent application security in architecture and design reviews.

Benefits

• A modern, international work environment and a dedicated, motivated team.
• Professional education and personal development opportunities.
• The opportunity to work on challenging, relevant issues in financial services and technology.
• A collaborative, flexible, and respectful work environment.
• Varied and challenging work supporting growth in product, functional, domain, and leadership skills.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed