Application Security Analyst

PlanetArt•Woodridge, IL

2d•Hybrid

About The Position

PlanetArt is seeking an Application Security Analyst to support its Security Department and help secure company applications. The analyst will manage vulnerabilities identified by Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and other application security tools, currently including Snyk, with possible future use of Semgrep. The role also oversees the Bug Bounty program, supports security notifications from the MSSP, conducts threat intelligence research, and contributes to governance, risk, compliance, cloud security, and third-party risk management activities. The analyst will use approved AI tools to support security analysis and remediation while independently validating AI-generated findings and recommendations. The role includes reviewing AI-generated code and AI-assisted development workflows, assessing AI-enabled applications and integrations for security risks, and helping development teams apply secure coding and testing practices. The position follows a hybrid schedule of three days onsite and two days remote. Candidates must be local to or willing to relocate to the office area.

Requirements

Bachelor’s degree in Computer Science, Cybersecurity, or equivalent experience.
3–5 years of experience in application security, vulnerability management, or a related role.
Hands-on experience with SAST/DAST tools; Snyk is required.
Knowledge of OWASP Top 10, CWE, and secure development practices.
Practical experience with generative AI or AI-assisted security and development tools, including writing effective prompts, verifying outputs, and recognizing inaccurate or unsupported results.
Working knowledge of large language models, common AI application security risks, and controls such as input and output validation, access restrictions, and sensitive-data protection.
Ability to evaluate AI-generated code and security recommendations through manual review and established testing tools.
Understanding of responsible AI use and data-handling requirements.
Familiarity with bug bounty platforms and coordinated vulnerability disclosure processes.
Understanding of threat intelligence processes and incident response workflows.
Strong written and verbal communication skills and ability to collaborate across technical and business teams.
Must be local to or willing to relocate to the office area; the position requires onsite work three days per week.

Nice To Haves

Experience with cloud platforms such as AWS, GCP, or Azure.
Experience with GRC frameworks such as NIST CSF, ISO 27001, or SOC 2.
Professional certifications such as GWAPT, OSWE, GWEB, CEH, or CISSP.
Familiarity with security testing of LLM applications, retrieval-augmented generation (RAG), AI agents, or AI service integrations.
Experience with Semgrep.

Responsibilities

Manage vulnerabilities identified through SAST, DAST, and other application security tools.
Validate, prioritize, and assign vulnerabilities to Application Development teams; track remediation and verify closure.
Oversee the Bug Bounty program, including triage, validation, and coordination with AppDev and external researchers.
Conduct threat intelligence research to identify risks to applications and the broader organization.
Validate, triage, and assign issues from MSSP security notifications.
Collaborate with AppDev to improve secure coding practices and provide remediation guidance.
Use approved AI tools for vulnerability triage, code review, threat research, and remediation guidance, and independently validate outputs.
Review AI-generated code and AI-assisted development workflows for security weaknesses and help AppDev teams use secure coding and testing practices.
Assess AI-enabled applications and integrations for risks including prompt injection, sensitive data exposure, insecure output handling, and excessive permissions.
Follow company AI-use policies, protect source code, credentials, and confidential data, and contribute guidance for evaluating AI tools and third-party AI services.
Contribute to organizational GRC initiatives, audits, and compliance efforts.
Support cloud security initiatives and third-party risk management reviews.