Application Security Analyst
About The Position
The Application Security Analyst identifies, analyzes, and mitigates application security vulnerabilities throughout the software development life cycle (SDLC). The role supports a “Shift Left” cybersecurity strategy by integrating security early in development and reinforcing it through DevSecOps practices. It is based in Auburn Hills, Michigan, and requires working on-site in the headquarters building five days per week. The analyst performs application security testing and assessments, analyzes findings, recommends secure coding fixes, demonstrates vulnerabilities to development teams, and drives remediation through closure. The role also integrates security controls into CI/CD workflows and leads Web Application Firewall (WAF) deployments for new and existing applications. Working with development, platform, and supplier teams, the analyst provides remediation guidance, trains teams on secure coding and application security, and develops training materials. The role tracks and reports risks, milestones, deliverables, and status updates, and recommends strategies based on application risk posture.
Requirements
- Bachelor’s degree in Computer Science, Information Technology, or a related field.
- At least 3 years of hands-on experience in application security, security testing, and DevSecOps.
- Strong understanding of web, mobile, and API application architectures.
- Knowledge of Agile and SDLC software development methodologies.
- Knowledge of modern programming languages, including Java, C#, and Python.
- Experience performing and interpreting results from SAST, DAST, IAST, SCA, and mobile security testing tools.
- Hands-on experience with secure code review in common languages; Java, C#, and Python are preferred.
- Prior application development background, including compiled code, web applications or services, and mobile app development.
- Knowledge of NIST, ISO 27001, and NIST SSDF or similar secure development frameworks.
- Strong understanding of OWASP Top 10 vulnerabilities and mitigation techniques, and common attack vectors such as web exploits, DDoS, and bot attacks.
- Experience with WAF technologies such as Akamai, Cloudflare, AWS WAF, or Azure Front Door.
- Familiarity with AWS, Azure, or GCP, and containers such as Docker and Kubernetes.
- Working knowledge of Java, JavaScript, SQL, and HTML.
- Working knowledge of scripting languages; Python and Bash are preferred.
- Strong analytical, problem-solving, and communication skills.
- Ability to explain technical risks to non-technical audiences.
- Experience writing security reports and documentation.
- Ability to work independently and cross-functionally.
Nice To Haves
- Industry certifications such as GIAC GWEB, ISC2 CSSLP, EC-Council CASE, or equivalent application security certifications.
- Python and Bash scripting experience.
Responsibilities
- Perform security testing, including SAST, DAST, IAST, mobile security, and dynamic testing.
- Analyze vulnerabilities and recommend secure coding fixes.
- Demonstrate vulnerabilities to development teams and drive remediation efforts to closure.
- Work within CI/CD pipelines and integrate security controls into development workflows.
- Lead Web Application Firewall (WAF) deployment for new and existing applications.
- Implement application security policies, controls, and standards.
- Partner with development, platform, and supplier teams.
- Provide clear remediation guidance, train teams on secure coding and application security practices, and develop training materials.
- Conduct security assessments using standard tools.
- Track and report risks, milestones, deliverables, and status updates.
- Recommend strategies based on application risk posture.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
