Security Analyst

ASM Research•Remote,

About The Position

The Security Analyst integrates application security practices throughout the software development life cycle for enterprise and mission-critical systems. The role partners with software engineering, architecture, DevOps, operations, and client stakeholders to translate security requirements into practical design, development, testing, deployment, and remediation activities. The Security Analyst conducts security architecture and design reviews, vulnerability assessments, and technical risk analyses; interprets findings; and guides application owners through prioritized mitigation and validation. The role also develops and enforces secure-development procedures, evaluates security tools and automation, and strengthens the organization’s application security posture in a highly regulated federal IT environment.

Requirements

Bachelor’s degree in Computer Science, Engineering, or another technical discipline, or equivalent relevant experience.
Typically 5–10 years of progressively responsible experience in application security, secure software engineering, vulnerability management, or a closely related cybersecurity discipline.
Demonstrated experience applying secure SDLC practices, including security requirements definition, threat modeling, architecture review, secure design patterns, and security acceptance criteria.
Experience assessing web applications, APIs, services, cloud-hosted workloads, and supporting infrastructure for vulnerabilities, insecure configurations, identity and access control weaknesses, and software security risks.
Ability to interpret, prioritize, and communicate findings from application-security testing, vulnerability scanning, dependency analysis, secrets scanning, container scanning, and penetration testing.
Strong working knowledge of vulnerability triage, risk scoring, exploitability analysis, compensating controls, remediation tracking, and validation of corrective actions.
U.S. citizenship is required, with the ability to obtain and maintain a Public Trust background investigation.

Nice To Haves

Professional security certification such as CSSLP, Security+, CISSP, a GIAC application-security credential, or a cloud-security certification.
Experience embedding automated security controls, policy gates, and scan-result workflows into CI/CD pipelines and infrastructure-as-code delivery processes.
Experience supporting application security activities within a highly regulated federal, defense, or government environment.
Experience conducting secure architecture reviews, applying threat-modeling methods, and remediating OWASP-aligned application-security risks.

Responsibilities

Integrate application security requirements, secure design practices, and security acceptance criteria across planning, development, testing, deployment, and maintenance phases of the software development life cycle.
Conduct and support security architecture reviews, threat modeling, secure design reviews, and vulnerability assessments for web applications, APIs, cloud-hosted workloads, services, and supporting infrastructure.
Analyze findings from static application security testing, dynamic application security testing, software composition analysis, dependency scanning, secrets scanning, container scanning, and penetration testing to determine risk and remediation priority.
Partner with development, DevOps, architecture, and operations teams to identify security risks, explain vulnerabilities, and provide practical, actionable mitigation recommendations.
Perform or support secure code reviews and assess applications for authentication and authorization weaknesses, insecure configurations, secrets exposure, common software weaknesses, and other security control gaps.
Track vulnerabilities and corrective actions through remediation, validate evidence of closure, and perform retesting as needed to confirm risk reduction.
Develop and maintain security procedures, technical standards, assessment reports, and risk communications that support informed authorization, remediation, and stakeholder decisions.
Evaluate application-security products and developer-facing tools for coverage, integration feasibility, operational impact, reporting quality, and compatibility with source-control and CI/CD workflows.