DevSecOps / Application Security Analyst

TEKsystems•Charlotte, NC

2d•$40 - $45•Hybrid

About The Position

We are building a brand-new DevSecOps and Application Security program and is seeking a DevSecOps/Application Security Analyst to help establish security standards across the organization's software development environment. This role will work directly with the DevSecOps Lead to implement secure CI/CD pipelines, manage application security scanning, drive vulnerability remediation efforts, and partner closely with development teams to strengthen the organization's overall security posture. This is an excellent opportunity for someone who enjoys building processes from the ground up and wants to have a direct impact on a growing security program. Serve as a day-to-day operator of the DevSecOps program, responsible for application security findings management, GitHub security administration, CI/CD security controls, pull request security reviews, repository onboarding, and developer engagement. Work closely with the DevSecOps Lead, security engineering resources, and development teams to keep findings actionable, exceptions tracked, security controls operational, and program metrics current. Support the Security Champions program and contribute to secure coding initiatives. This is a hands-on role operating at the intersection of software development, security operations, and application security.

Requirements

Experience in DevSecOps and Application Security.
Ability to establish security standards across a software development environment.
Experience implementing secure CI/CD pipelines.
Experience managing application security scanning.
Experience driving vulnerability remediation efforts.
Ability to partner closely with development teams.
Experience with findings management.
Experience with GitHub security administration.
Experience with CI/CD security controls.
Experience with pull request security reviews.
Experience with repository onboarding.
Experience with developer engagement.
Experience with SAST, DAST, SCA, secrets detection, IaC, and container security tools.
Ability to validate findings, classify severity, and manage false-positive disposition.
Ability to explain vulnerabilities and remediation approaches to developers.
Ability to monitor CI/CD security gate results and escalate issues.
Ability to track and maintain a security exception register.
Ability to manage a security findings backlog, including ticket creation, prioritization, assignment, SLA tracking, remediation validation, escalation, and closure verification.

Responsibilities

Serve as a day-to-day operator of the DevSecOps program.
Manage application security findings.
Administer GitHub security.
Implement and manage CI/CD security controls.
Conduct pull request security reviews.
Onboard new repositories.
Engage with developers on security matters.
Keep findings actionable, exceptions tracked, security controls operational, and program metrics current.
Support the Security Champions program.
Contribute to secure coding initiatives.
Triage daily findings from SAST, DAST, SCA, secrets detection, IaC, container security, and repository security tools.
Validate findings, classify severity, and manage false-positive disposition with documented rationale.
Review pull requests for security findings and work with developers to explain vulnerabilities and remediation approaches.
Monitor CI/CD security gate results and escalate blocked builds when exceptions or engineering support are required.
Track and maintain the security exception register.
Manage the security findings backlog, including ticket creation, prioritization, assignment, SLA tracking, remediation validation, escalation of overdue items, and closure verification.