Application Security Analyst

Barclays•Hanover Township, NJ

2d•$125,000 - $170,000

About The Position

The Application Security Analyst will support the delivery and continuous enhancement of Barclays’ Application Security and DevSecOps capabilities. The role uses practical experience with application security testing, including SAST, SCA, DAST, API security, and AI-assisted security testing, to evaluate findings, validate risk, support remediation, and turn test data into practical insights for engineering and security stakeholders. The analyst will help embed security controls throughout the software development lifecycle and support compliance with cyber governance requirements, policies, and standards. The position also involves assessing banks’ IT systems, applications, servers, and networks for vulnerabilities through penetration testing, audits, and threat modeling. The analyst communicates findings and remediation guidance, collaborates with stakeholders and IT teams on testing methodologies and security requirements, and monitors emerging vulnerabilities, exploit code, and cyber-attack techniques. The role is located in Whippany, New Jersey. At the Assistant Vice President level, the role is expected to advise and influence decisions, contribute to policy development, take responsibility for operational effectiveness, manage risk and controls, and collaborate across business functions. Depending on whether the role has leadership responsibilities, it may include leading and coaching a team or leading collaborative assignments and guiding colleagues. The position also calls for complex analysis, consultation on escalated issues, and effective communication and influence with stakeholders. Barclays colleagues are expected to demonstrate the company’s Values and Mindset.

Requirements

Experience running one or more SAST, SCA, or DAST scans and triaging and validating findings.
Experience investigating false positives and assessing security finding severity and exploitability.
Experience working with developers to track remediation.
Experience testing APIs and understanding common weaknesses in authentication, authorization, input validation, data exposure, and business logic.
Secure coding knowledge in at least one development ecosystem, such as Java/Spring, .NET, Go, Python, or JavaScript/TypeScript.
Experience supporting security testing within CI/CD and cloud-native workflows.
Ability to evaluate security data using spreadsheets, query tools, or reporting tools to identify trends, prioritize risk, monitor remediation, and produce operational metrics and dashboards.

Nice To Haves

Knowledge of cyber governance, security policies, controls, and standards, including conformance assessments, evidence collection, exception management, and risk reporting.
Understanding of secure SDLC practices, software supply chain security, dependency risk, secrets scanning, SBOMs, vulnerability management, and developer-focused remediation.
Exposure to AI-assisted security testing and AI application security risks, including prompt injection, insecure output handling, sensitive-data leakage, model or agent vulnerabilities, and validation of AI-generated findings.

Responsibilities

Develop and execute assessments, audits, and threat models to identify vulnerabilities in systems, applications, and servers using penetration testing tools and techniques.
Communicate penetration test findings, risks, and recommendations to stakeholders.
Collaborate with stakeholders and IT teams to identify emerging cyber-attack techniques, tools, and technologies and support penetration testing methodologies.
Prepare and maintain comprehensive reports for senior stakeholders on test findings and remediation guidance.
Work with stakeholders to understand security requirements and controls in business processes, applications, and services.
Identify emerging vulnerabilities, exploit code, and cyber-attacks to develop testing methodologies and assurance activities.
Evaluate application security findings, validate risk, support remediation, and provide practical insights to engineering and security stakeholders.
Help embed security controls across the software development lifecycle and support compliance with cyber governance requirements, policies, and standards.
Run SAST, SCA, or DAST scans; triage and validate findings; investigate false positives; assess severity and exploitability; and work with developers to track remediation.
Test APIs for weaknesses in authentication, authorization, input validation, data exposure, and business logic.
Use security data and reporting tools to identify trends, prioritize risk, monitor remediation, and produce operational metrics and dashboards.
Take ownership of managing risk and strengthening controls related to the work.
Advise and influence decision-making, contribute to policy development, and support operational effectiveness.
Depending on role leadership responsibilities, lead and coach employees or guide team members through collaborative assignments.
Consult on complex issues and advise People Leaders on escalated issues.
Analyze information from multiple sources to solve problems and communicate complex information to stakeholders.