Application & Cloud Security Specialist (DAST Specialist)

KeyBank • Brooklyn, OH

12d • $69,000 - $105,000

About The Position

The Application & Cloud Security Specialist is part of Key’s Cyber Application & Cloud Defense team within Corporate Information Security. The team works to enable secure software delivery and resilient cloud environments by proactively identifying, assessing, and reducing application and cloud security risks.

The role configures and optimizes automated dynamic testing tools for API scanning and Dynamic Application Security Testing (DAST), and implements DAST and API scans in CI/CD pipelines and on schedules. It also performs application security assessments, manual penetration testing, and cloud security reviews across modern development and cloud-native environments, using SAST, SCA, DAST, and CSPM capabilities.

The specialist works with development, DevOps, and cloud engineering teams to integrate security into CI/CD pipelines and improve secure coding practices. The role calls for technical depth, development experience, command-line proficiency, and a hands-on, execution-focused approach. It also uses modern tools, including AI-powered development and security assistants, to improve productivity, testing depth, and vulnerability detection while maintaining secure and responsible usage.

Requirements

• Bachelor’s degree in Computer Science, Cybersecurity, or a related field, or equivalent experience.
• At least 4 years of experience in application security, penetration testing, or secure software development.
• Hands-on experience with manual application security testing of web applications and APIs.
• Experience with SAST, SCA, and DAST tools.
• Knowledge of common vulnerabilities, including OWASP Top 10 and API risks.
• Experience with at least one cloud platform: Google Cloud, Microsoft Azure, or AWS.
• Strong programming or scripting experience in Python, Java, JavaScript, Bash, PowerShell, or a similar language.
• Proficiency working in Linux/Unix command-line environments.
• Familiarity with CI/CD pipelines and DevSecOps practices.
• Experience with or comfort using AI-enabled tools and coding assistants for code analysis, automation, or testing support.

Nice To Haves

• Experience with application security tools such as Snyk, Burp Suite, or API security tools.
• Familiarity with containers, Kubernetes, and cloud-native architectures.
• Exposure to infrastructure-as-code (IaC) security practices.
• GIAC Cloud Security Automation (GCSA) certification.
• GIAC Web Application Penetration Tester (GWAPT) certification.
• Offensive Security Web Expert (OSWE) certification.
• Cloud security certification for AWS, Azure, or GCP.

Responsibilities

• Implement automated dynamic application security testing tools across web applications, APIs, and distributed systems.
• Validate and tune API and DAST scan configurations to ensure sufficient coverage and improve signal-to-noise ratio.
• Perform manual application security testing and penetration testing of web applications, APIs, and services.
• Review and validate SAST, SCA, and DAST findings, including triage and false-positive reduction.
• Conduct API security and dynamic testing to identify vulnerabilities and misconfigurations.
• Assess open-source dependencies and third-party libraries for vulnerabilities and supply-chain risk.
• Evaluate GCP, Azure, and AWS environments for misconfigurations, excessive permissions, and exposure risks in support of the CSPM program.
• Implement and maintain CI/CD security integrations, including scanning tools and automation workflows.
• Develop scripts and CLI-based tooling to support scalable security testing and validation activities.
• Partner with development teams to remediate vulnerabilities and improve secure coding practices.
• Participate in architecture and design reviews and provide actionable security recommendations.
• Use AI tools and coding assistants to enhance productivity, automate analysis, and improve testing efficiency while maintaining secure and responsible usage practices.
• Track and report vulnerabilities, remediation progress, and security metrics.

Benefits

• Eligible for incentive compensation, which may include production, commission, and/or discretionary incentives.
• The posting refers to a separate list of benefits for which the position is eligible, but does not specify those benefits.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level