Application Security Consultant - DAST

MassMutual • Springfield, MA

10d

About The Position

MassMutual is seeking an experienced Application Security Consultant to advance application security initiatives, with an emphasis on dynamic application security testing (DAST). The consultant will own and mature testing of running applications and APIs for exploitable weaknesses, promote secure development practices, and implement solutions that protect systems and data from evolving threats. The role partners with development teams, security architects, leadership, and other stakeholders to embed security throughout the software development lifecycle.

The Application Security team assesses applications and works proactively with development teams to identify and verify vulnerabilities, perform hands-on dynamic testing of applications and APIs, implement security best practices, and help teams remediate findings. The role advances DAST across the web application and API estate, integrates dynamic testing into delivery workflows, and complements automated testing with manual assessment. It also supports secure architecture and coding practices, application-security incident response, compliance, risk reporting, and developer education.

This is a full-time role in Springfield, Massachusetts. The stated salary range is $137,800–$180,800. MassMutual notes that compensation may include a bonus target or, for sales-focused roles, variable incentive compensation. The company describes its culture as inclusive, vibrant, diverse, collaborative, and focused on growth and customer service, and refers applicants to its Total Rewards at a Glance for benefits information.

Requirements

• Bachelor’s degree.
• At least 8 years of experience in application security, penetration testing, or secure software development.
• Hands-on expertise with DAST tools, including authenticated scan configuration, scan policy tuning, and API scanning.
• Hands-on experience conducting DAST of web applications and APIs.
• Experience operationalizing DAST at scale, including pipeline integration, scheduled scanning across a large application estate, results triage workflows, and reducing false positives.
• Strong knowledge of secure software development methods, including threat modeling, code review, and static and dynamic analysis.
• Deep understanding of common application vulnerabilities, such as the OWASP Top 10, their mitigations, and manual verification and exploitation of findings to confirm risk.
• Experience integrating security into DevOps and CI/CD environments.
• Technical knowledge of web application security, cloud security, mobile security, infrastructure as code, containerized environments, and API security.
• Strong technical knowledge of cloud platforms such as AWS, Azure, or GCP; Docker and Kubernetes; and application security.
• Experience identifying security defects in container images and Kubernetes environments.
• Advanced proficiency writing source code in at least one programming language, such as Java, JavaScript, C/C++, C#, or Python.
• Familiarity with build and dependency tools such as Maven, Gradle, or Node.
• Experience with cloud deployment and automation tools such as Terraform, GitHub Actions, Jenkins, AWS CloudFormation, and secrets managers.
• Working knowledge of encryption, authentication, and access control.
• Knowledge of compliance and regulatory frameworks, such as SOC 2.
• Strong analytical and problem-solving skills and the ability to explain security issues to technical and non-technical stakeholders.
• Collaborative team player comfortable in a fast-paced environment.

Nice To Haves

• Security certifications such as CEH, OSCP, CISSP, or GWAPT from an industry-recognized certifier such as SANS/GIAC, CompTIA, ISACA, or ISC2.
• Hands-on experience with the wider security testing toolchain, including SAST, SCA, IAST, and fuzzing tools.

Responsibilities

• Own and advance the DAST program, including selecting, deploying, configuring, and maintaining tooling across web applications and APIs.
• Design and run authenticated dynamic scans of complex applications, including applications with session handling, multi-step workflows, single-page applications, and REST or GraphQL APIs.
• Integrate DAST into CI/CD pipelines and pre-production environments, and define release-gating thresholds.
• Triage, validate, and tune DAST results, reduce false positives, manually verify exploitability, and provide actionable remediation guidance.
• Use manual testing to identify, assess, and prioritize application vulnerabilities that automated scanners may not find.
• Conduct security assessments, including vulnerability scanning and code review.
• Perform threat modeling to identify attack vectors and weaknesses, and use results to focus dynamic test coverage on higher-risk areas.
• Collaborate with security architects on secure application architectures and ensure secure coding practices and controls are incorporated into software designs.
• Partner with the SDLC Council to develop and maintain secure coding standards.
• Work with DevOps teams to implement security controls in CI/CD pipelines.
• Maintain the broader application security testing toolchain, including SAST and SCA alongside DAST.
• Evaluate third-party software and APIs for security compliance, including dynamic testing of externally sourced components when appropriate.
• Support application-security incident response by providing rapid identification and mitigation guidance.
• Help ensure compliance with applicable security regulations, frameworks, and industry standards.
• Use reporting tools and KPIs, KRIs, and OKRs to communicate vulnerability and code-defect risk and support risk-based prioritization.
• Educate developers and stakeholders on secure coding and interpreting and acting on dynamic test results.
• Monitor security threats, vulnerabilities, and industry trends and apply relevant developments to improve security strategy.

Benefits

• Competitive pay and benefits; further benefits information is referenced through MassMutual’s Total Rewards at a Glance.
• Incentive and bonus opportunities, including a bonus target or variable incentive compensation for sales-focused roles.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior