Application Security Analyst

PlanetArt•Woodridge, IL

10d•$80,000 - $120,000•Hybrid

About The Position

PlanetArt is seeking an Application Security Analyst to support its Security Department and help secure company applications. The role manages vulnerabilities identified through Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and other application security tools, including Snyk and potentially Semgrep. It also oversees the Bug Bounty program, supports security notifications from the MSSP, conducts threat intelligence research, and contributes to governance, risk, compliance (GRC), cloud security, and third-party risk management activities. The analyst uses approved AI tools to support security analysis and remediation, independently evaluates AI-generated results, and helps assess the security of AI-enabled applications and development workflows. This is a hybrid position requiring three days onsite and two days remote. Candidates must be local to or willing to relocate to the office area.

Requirements

Bachelor’s degree in Computer Science, Cybersecurity, or equivalent experience.
3–5 years of experience in application security, vulnerability management, or a related role.
Hands-on experience with SAST/DAST tools; Snyk is required.
Knowledge of OWASP Top 10, CWE, and secure development practices.
Practical experience using generative AI tools or AI-assisted security and development tools, including writing effective prompts, verifying outputs, and recognizing inaccurate or unsupported results.
Working knowledge of large language models (LLMs), common AI application security risks, and controls such as input and output validation, access restrictions, and protection of sensitive data.
Ability to evaluate AI-generated code and security recommendations through manual review and established testing tools.
Understanding of responsible AI use and data handling requirements.
Familiarity with bug bounty platforms and coordinated vulnerability disclosure processes.
Understanding of threat intelligence processes and incident response workflows.
Strong written and verbal communication skills and ability to collaborate across technical and business teams.
Must be local to or willing to relocate to the office area for the hybrid work model.

Nice To Haves

Experience with Semgrep.
Experience with cloud platforms such as AWS, GCP, or Azure.
Experience with GRC frameworks such as NIST CSF, ISO 27001, or SOC 2.
Professional certifications such as GWAPT, OSWE, GWEB, CEH, or CISSP.
Familiarity with security testing of LLM applications, retrieval-augmented generation (RAG), AI agents, or AI service integrations.

Responsibilities

Manage vulnerabilities identified through SAST, DAST, and other application security tools.
Validate, prioritize, and assign vulnerabilities to Application Development teams; track remediation and verify closure.
Oversee the Bug Bounty program, including triage, validation, and coordination with AppDev and external researchers.
Conduct threat intelligence research to identify risks to applications and the broader organization.
Validate, triage, and assign security issues from MSSP-provided notifications.
Collaborate with AppDev to improve secure coding practices and provide remediation guidance.
Use approved AI tools for vulnerability triage, code review, threat research, and remediation guidance, and independently validate findings and recommendations.
Review AI-generated code and AI-assisted development workflows for security weaknesses and help AppDev teams apply secure coding and testing practices.
Assess AI-enabled applications and integrations for risks including prompt injection, sensitive data exposure, insecure output handling, and excessive permissions in AI agents and connected tools.
Follow company AI-use policies, protect source code, credentials, and confidential data, and contribute guidance for evaluating AI tools and third-party AI services.
Contribute to organizational GRC initiatives, audits, and compliance efforts.
Support cloud security initiatives and third-party risk management reviews.