Application Security Analyst

Required Skills & Experience

-5+ years of experience within Application Security Testing, including:
SAST (Static Application Security Testing)
DAST (Dynamic Application Security Testing)
SCA (Software Composition Analysis)
- Strong vulnerability management experience, including reviewing, assessing, prioritizing, and tracking application security vulnerabilities.
- Previous software development experience with one or more of:
Python
Java
.NET
- Hands-on experience reviewing and triaging application security scan findings.
- Ability to work with development teams to determine appropriate remediation strategies for identified vulnerabilities.
- Experience validating false positives raised by development teams and determining whether findings represent legitimate security risks.
- Experience providing reporting and documentation around discrepancies, including situations where security scan results and development team assessments do not align.
- Strong understanding of application security vulnerabilities and the ability to communicate the risk, impact, and recommended remediation to technical stakeholders.
- Strong communication and advisory skills, with the ability to effectively deliver security findings and recommendations to another line of business.

Nice to Have Skills & Experience

- Experience with AI / LLM security testing.
- Exposure to assessing security risks associated with AI-enabled applications or Large Language Models.
- Experience working in a banking, financial services, or highly regulated enterprise environment.
- Experience operating in an application security advisory or consulting capacity.

Job Description

We are looking for an experienced Application Security Analyst to act as a security advisor supporting another line of business within a large banking environment. This individual will partner closely with development and technology teams to assess application security vulnerabilities, review security testing results, and help teams understand and remediate identified risks.

The ideal candidate will have strong hands-on experience with application security testing, vulnerability management, and software development, along with the communication skills needed to clearly explain security findings and recommendations to development and business stakeholder to remediate/triage findings.