Application Security Specialist

Barclays•Jefferson, CO

4d•$175,000 - $225,000

About The Position

The Lead Application Security Analyst safeguards Barclays’ technology landscape by leading the evaluation, delivery, and continuous enhancement of Application Security and DevSecOps capabilities. The role brings specialist experience in one or more areas such as SAST, SCA, DAST, API security, and AI-assisted security testing. It translates complex security-testing data into actionable risk insights, embeds proportionate controls across the software development lifecycle, and partners with engineering, risk, and governance stakeholders to improve control effectiveness, standards compliance, and secure innovation. The position identifies vulnerabilities in bank systems, applications, servers, and networks through assessments, audits, threat modeling, and penetration-testing techniques. It develops testing methodologies, communicates findings and remediation guidance, and works with stakeholders to understand security requirements and strengthen the bank’s overall security posture. The role also provides authoritative technical challenge, advises senior stakeholders, manages risk and controls, and may guide technical direction, coach less-experienced specialists, and contribute to strategic decisions. The role is located in Whippany, New Jersey. The stated base salary range is $175,000 to $225,000, and the position is eligible for an incentive award. Barclays employees are eligible for medical, dental, and vision coverage, a 401(k), life insurance, and other paid leave for qualifying circumstances.

Requirements

Experience operating and evaluating results from one or more SAST, SCA, or DAST tools, including policy tuning, finding validation, false-positive reduction, exploitability assessment, and remediation guidance.
Experience assessing APIs using automated and manual techniques, with knowledge of authentication, authorization, input validation, and common API vulnerabilities.
Experience applying secure coding and remediation practices in at least one development ecosystem, such as Java/Spring, .NET, Go, Python, or JavaScript/TypeScript.
Experience integrating application-security testing into CI/CD pipelines, developer workflows, and cloud-native environments, including containers, Kubernetes, and infrastructure as code.
Ability to use data-analysis techniques and reporting tools to identify trends, prioritize risk, monitor remediation, and produce KRI/KCI dashboards and leadership insights.
Technical-analysis skills, including defining testing strategies and providing authoritative challenge to engineering teams on detailed application-security risks.
Ability to translate complex technical findings into actionable risk insights and communicate them to stakeholders.
Ability to collaborate with engineering, risk, governance, IT, and other stakeholders.
Ability to manage and mitigate risks and strengthen controls.
Ability to apply analytical and interpretive thinking to complex problems and develop solutions.
Ability to build and maintain trusting relationships and use influencing and negotiating skills to achieve business objectives.

Nice To Haves

Knowledge of cyber governance, security policies, control frameworks, and standards, including interpreting requirements, assessing conformance, managing exceptions, and supporting audit or regulatory evidence.
Understanding of software supply-chain security, dependency risk, secrets scanning, SBOMs, and vulnerability management across the secure SDLC.
Exposure to AI-assisted security testing and AI application security, including prompt injection, insecure output handling, model and agent risks, data leakage, human-in-the-loop validation, and responsible use of AI-generated findings.
Ability to communicate complex technical findings to senior stakeholders, influence remediation priorities, and coach analysts and engineering teams.
Experience in one or more specialist areas such as SAST, SCA, DAST, API security, or AI-assisted security testing.

Responsibilities

Develop and execute assessments, audits, threat models, and penetration-testing activities to identify vulnerabilities in systems, applications, and servers.
Communicate security findings, risk insights, and recommendations to stakeholders, including senior leaders.
Collaborate with stakeholders and IT teams to identify emerging cyber-attack techniques, tools, and technologies and support penetration-testing methodologies.
Develop and maintain reports on penetration-test findings and remediation guidance.
Work with stakeholders to understand security requirements and controls in business processes, applications, and services.
Lead evaluation, delivery, and continuous enhancement of Application Security and DevSecOps capabilities.
Operate and evaluate SAST, SCA, or DAST tools; tune policies, validate findings, reduce false positives, assess exploitability, and guide remediation.
Assess APIs using automated and manual techniques.
Embed application-security testing and proportionate controls into the software development lifecycle, CI/CD pipelines, developer workflows, and cloud-native environments.
Use data analysis and reporting to identify trends, prioritize risk, monitor remediation, and produce KRI/KCI dashboards and leadership insights.
Define testing strategies and provide authoritative challenge to engineering teams on detailed application-security risks.
Interpret security requirements, assess conformance, manage exceptions, and support audit or regulatory evidence.
Manage and mitigate risks through assessment and strengthen controls in support of governance requirements.
Advise key stakeholders and senior management on functional and cross-functional impacts and alignment.
Build and maintain stakeholder relationships, influence remediation priorities, and coach analysts and engineering teams.
Identify emerging vulnerabilities, exploit code, and cyber-attacks to develop testing methodologies and assurance activities.