Application Security Analyst

HEXAWARE•United States,

About The Position

Hexaware Technologies is seeking an Application Security Analyst to join its cybersecurity team. The role identifies, analyzes, and mitigates application security risks through security assessments, penetration testing, secure code reviews, and vulnerability management. The analyst works with development, architecture, and engineering teams to strengthen security and promote secure-by-design practices throughout the software development lifecycle. The position covers web applications, APIs, microservices, backend systems, and modern cloud-native and API-driven architectures. It includes identifying and prioritizing vulnerabilities, analyzing root causes and business impact, supporting remediation, validating fixes, developing repeatable testing procedures, and communicating findings to technical and non-technical stakeholders.

Requirements

Strong experience performing manual application security assessments and penetration testing.
Deep understanding of common application security vulnerabilities and attack techniques.
Hands-on experience identifying and exploiting application security weaknesses in web applications, APIs, and backend services.
Strong understanding of secure design principles and secure development practices.
Proven experience conducting manual source code reviews.
Ability to identify insecure coding practices and provide guidance on secure coding standards.
Experience reviewing code in one or more of these languages or technologies: Java, C#, Python, JavaScript/TypeScript, Go, or Node.js.
Strong knowledge of OWASP Top 10, OWASP ASVS, secure coding best practices, application security testing methodologies, and industry security controls and frameworks.
Understanding of authentication, authorization, session management, encryption, and API security principles.
Experience assessing vulnerability severity using industry-standard methodologies.
Strong analytical and problem-solving skills.
Excellent written and verbal communication skills.
Ability to communicate effectively with developers, architects, project teams, and executive stakeholders.

Nice To Haves

Previous software development experience.
Familiarity with microservices, REST APIs, cloud-native applications, containerized environments, or DevSecOps practices.
Experience working in Agile development environments.
Exposure to CI/CD security testing and automation.
Industry certifications such as GWAPT, GPEN, OSCP, CSSLP, CISSP, or CEH.

Responsibilities

Perform manual security assessments of web applications, APIs, microservices, and backend systems.
Conduct application penetration testing to identify vulnerabilities, attack vectors, and exploitation opportunities.
Conduct secure code reviews to identify insecure coding practices and assess adherence to security standards.
Assess application architectures and recommend security improvements throughout the SDLC.
Identify, validate, and prioritize vulnerabilities based on exploitability, business impact, and risk.
Analyze security findings and determine root causes.
Partner with development teams to provide remediation guidance and security best practices.
Evaluate risks in modern application architectures, including cloud-native and API-driven environments.
Use security testing tools and platforms, including Burp Suite, OWASP ZAP, security proxies, web application scanners, fuzzing tools, and API testing platforms.
Re-test and verify remediation efforts.
Develop repeatable testing methodologies and security assessment procedures.
Produce detailed security assessment reports covering scope and methodology, technical findings and evidence, severity ratings, root cause analysis, business impact, and remediation recommendations.
Present security findings and communicate risks and remediation priorities to technical and non-technical stakeholders, including development and leadership teams.