Application Security Analyst

PNC•Strongsville, OH

1d•$75,000 - $137,500•Onsite

About The Position

The Application Security Analyst is part of PNC's Technology organization and provides technical evaluation and analysis to help improve the organization's overall security posture. The role applies security concepts, reviews information and requirements, executes defined tasks, analyzes logs, and creates documentation. It also supports investigations, data loss prevention, data manipulation, coordination of activities, and actions to address or mitigate risks and vulnerabilities. The analyst reviews and defines controls, contributes to enforcing controls against security risks and threats, and advises on security procedures and products. The role conducts security assessments and other information security routines, investigates data-security issues, and recommends corrective actions in accordance with established guidelines. It also shares knowledge with staff and works with developers, product managers, and other partners to communicate security findings and reinforce repeatable security practices. The position is based in a PNC office in Denver, Phoenix, Birmingham, Dallas, Pittsburgh, or Cleveland. PNC describes itself as an in-office company and encourages candidates to discuss workplace expectations with their recruiter and hiring manager.

Requirements

Knowledge of common application security concepts and vulnerability types, such as the OWASP Top 10, and ability to learn their real-world applications.
Exposure to the Software Development Lifecycle (SDLC) and interest in how security fits into design, development, and testing.
Ability to analyze information, follow defined security processes, and execute assigned tasks with attention to detail.
Strong analytical and problem-solving skills to identify potential risks and support remediation under guidance.
Effective communication skills for explaining security findings, vulnerabilities, and risks to developers, product managers, and non-security partners.
Willingness to coach and educate partners on security processes and expectations.
Ability to work independently on assigned tasks and collaboratively with cross-functional teams.
Familiarity with Agile delivery concepts such as Scrum or Kanban.
Typically, a university or college degree and 3 or more years of relevant or direct industry experience; a comparable combination of education, job-specific certifications, and experience may be considered in lieu of a degree.
Bachelor's degree listed under education qualifications.

Nice To Haves

Hands-on exposure to application security, secure coding concepts, or software development.
Familiarity with security testing concepts or tools, such as vulnerability scanning results or SAST/DAST outputs.
Knowledge of security frameworks, standards, or best practices such as OWASP or NIST, or strong interest in developing that knowledge.
Exposure to cloud computing concepts or modern application architectures such as APIs and microservices.
Entry-level or foundational security certifications, such as Security+ or GIAC Fundamentals, or progress toward a relevant certification.
Demonstrated interest in application security, product security, or secure software development through academic projects, personal learning, or prior roles.
Strong documentation skills for creating clear notes, assessments, and evidence supporting security processes and controls.
Certifications are often desired.

Responsibilities

Provide technical evaluation and analysis to support improvements to the organization's overall security posture.
Apply security concepts, review information and requirements, execute defined tasks, analyze logs, and create documentation.
Perform investigations, data loss prevention, data manipulation, and coordination of activities.
Take actions to address or mitigate security risks and vulnerabilities.
Review and define controls and participate in enforcing controls against security risks and threats.
Advise on security procedures and products for clients, security administrators, and network operations.
Conduct security assessments and other information security routines consistently.
Investigate data-security issues and recommend corrective actions in accordance with established guidelines.
Share security knowledge with staff and help partners understand security processes and expectations.
Communicate security findings, vulnerabilities, and risks clearly to technical and non-security partners.

Benefits

Medical and prescription drug coverage, with a Health Savings Account feature.
Dental and vision options.
Employee and spouse/child life insurance.
Short- and long-term disability protection.
401(k) with PNC match.
Pension and stock purchase plans.
Dependent care reimbursement account.
Back-up child and elder care.
Adoption, surrogacy, and doula reimbursement.
Educational assistance, including select programs that are fully paid.
Wellness program with financial incentives.
Maternity and/or parental leave.
Up to 11 paid holidays each year.
9 occasional absence days each year, unless otherwise required by law.
15 to 25 vacation days each year, depending on career level and years of service.