Application Security Analyst II

Little Caesars•Detroit, MI

12d

About The Position

The Application Security Analyst II supports the organization’s application security program by identifying, assessing, and helping remediate security risks throughout the software development lifecycle. The role partners with application development, engineering, architecture, infrastructure, risk, privacy, compliance, and cyber security teams to promote secure design and development practices. It performs application security assessments, supports security testing and vulnerability management, documents security requirements, and helps integrate security controls into development and deployment processes. The position also supports application security tools and processes, communicates actionable guidance to technical teams, tracks risks and remediation, and participates in project, change, architecture, and security governance reviews as needed. It requires effective collaboration, customer orientation, analytical problem-solving, clear communication, self-motivation, and the ability to manage competing responsibilities with general direction.

Requirements

Bachelor’s degree in Computer Science, Computer Engineering, Information Technology, Cyber Security, or a related technical field; a minimum of four years of relevant industry experience may be considered instead of a formal degree.
At least three years of information technology experience, including at least one year in information security, application development, application security, or a closely related discipline.
Working knowledge of secure software development lifecycle practices and applying security requirements within Agile or other development methodologies.
Working knowledge of common application and API vulnerabilities, including the OWASP Top 10, and practical prevention and remediation approaches.
Experience with one or more application security testing approaches or technologies, such as SAST, DAST, SCA, API security testing, secrets scanning, or container security scanning.
Ability to review and interpret application security findings, assess business and technical risk, and communicate clear remediation guidance to development and engineering teams.
Understanding of secure coding concepts and application security controls, including authentication, authorization, input validation, session management, encryption, secrets management, logging, and error handling.
Understanding of web technologies, APIs, cloud-hosted applications, source code management, and CI/CD concepts.
Familiarity with vulnerability management, risk acceptance, exception handling, and remediation tracking processes.
Strong analytical, problem-solving, documentation, and communication skills.
Ability to collaborate across teams, consider customer needs, analyze information, communicate effectively with technical and non-technical audiences, work independently with general direction, and manage competing responsibilities and deadlines.

Nice To Haves

Hands-on experience with enterprise application security tools and developer security workflows.
Experience integrating security testing into CI/CD pipelines and development platforms.
Familiarity with programming or scripting languages and the ability to understand application code.
Familiarity with cloud-native application architectures, containers, microservices, and infrastructure as code.
Application security or security-related certifications such as CSSLP, GIAC, CISSP, Security+, or comparable credentials.

Responsibilities

Perform application security assessments for new and existing applications, APIs, integrations, and supporting services.
Conduct or coordinate application security testing, including SAST, DAST, SCA, API security testing, and manual validation as appropriate.
Analyze security findings, validate risk and impact, reduce false positives, and work with development teams to prioritize and remediate vulnerabilities.
Participate in application threat modeling and secure design reviews, identifying risks and recommending practical controls before deployment.
Define, document, communicate, and maintain application security requirements, standards, procedures, and guidance.
Partner with development and engineering teams to integrate security checks and guardrails into source code management and CI/CD pipelines.
Advise on secure coding and application security topics, including vulnerabilities, authentication, authorization, session management, secrets management, data protection, and API security.
Track application security risks, remediation plans, exceptions, and metrics; escalate material risks or overdue remediation through governance processes.
Support the evaluation, implementation, administration, and continuous improvement of application security tools and processes.
Develop security guidance and share actionable application security recommendations with technical teams.
Participate in project, change, architecture, and security governance reviews as needed.
Maintain awareness of emerging application security threats, vulnerabilities, attack techniques, and industry practices.