Application Security Analyst
About The Position
The Application Security Analyst identifies, analyzes, and mitigates application security vulnerabilities throughout the software development lifecycle. The role supports a “Shift Left” cybersecurity strategy by integrating security early in development and reinforcing it through DevSecOps practices. Based at the company’s headquarters in Auburn Hills, Michigan, this position requires on-site work five days per week. The analyst performs application security testing and assessments, recommends secure coding fixes, demonstrates vulnerabilities to development teams, and drives remediation to closure. The role also integrates security controls into CI/CD workflows, leads Web Application Firewall deployments for new and existing applications, and collaborates with development, platform, and supplier teams. Additional responsibilities include providing secure-coding guidance and training, preparing training materials and security documentation, and tracking and reporting risks, milestones, deliverables, and status updates. The analyst recommends strategies based on application risk posture.
Requirements
- Bachelor’s degree in Computer Science, Information Technology, or a related field.
- At least 3 years of hands-on experience in application security, security testing, and DevSecOps.
- Strong understanding of web, mobile, and API application architectures.
- Understanding of Agile, SDLC, and other software development methodologies.
- Experience with modern programming languages, including Java, C#, and Python.
- Experience performing and interpreting results from SAST, DAST, IAST, SCA, and mobile security testing tools.
- Hands-on experience with secure code review in common languages; Java, C#, and Python are preferred.
- Prior application development background, including compiled code, web applications or services, and mobile app development.
- Knowledge of NIST, ISO 27001, and NIST SSDF or similar secure development frameworks.
- Strong understanding of OWASP Top 10 vulnerabilities and mitigation techniques, as well as common attack vectors such as web exploits, DDoS, and bot attacks.
- Experience with WAF technologies such as Akamai, Cloudflare, AWS WAF, or Azure Front Door.
- Familiarity with AWS, Azure, or GCP and container environments including Docker and Kubernetes.
- Working knowledge of Java, JavaScript, SQL, and HTML.
- Working knowledge of scripting languages; Python and Bash are preferred.
- Strong analytical, problem-solving, and communication skills.
- Ability to work independently and cross-functionally.
- Ability to explain technical risks to non-technical audiences.
- Experience writing security reports and documentation.
Nice To Haves
- GIAC GWEB certification.
- ISC2 CSSLP certification.
- EC-Council CASE certification.
- Equivalent application security certifications.
Responsibilities
- Perform SAST, DAST, IAST, mobile security, and dynamic testing.
- Analyze vulnerabilities and recommend secure coding fixes.
- Demonstrate vulnerabilities to development teams and drive remediation efforts to closure.
- Work with CI/CD pipelines and integrate security controls into development workflows.
- Lead Web Application Firewall deployment for new and existing applications.
- Implement application security policies, controls, and standards.
- Partner with development, platform, and supplier teams.
- Provide remediation guidance and train teams on secure coding and application security practices.
- Develop training materials.
- Conduct security assessments using standard tools.
- Track and report risks, milestones, deliverables, and status updates.
- Recommend strategies based on application risk posture.
- Explain technical risks to non-technical audiences and write security reports and documentation.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
