Application Security Analyst

Looking for an Application Security Analyst/Engineer with 5 to 7 years of hands-on experience in application security assessments, including architecture/design review, code analysis, penetration testing, and third-party/vendor risk reviews. The ideal candidate will possess strong expertise in secure coding, security testing tools, and key protocols.

Key Responsibilities

• Conduct application security assessments: architecture/design reviews, code reviews, and penetration testing.
• Utilize SAST and DAST tools to uncover vulnerabilities in both code and running applications.
• Analyze and document penetration testing results, highlighting risk areas and recommending countermeasures.
• Perform vendor risk assessments to ensure compliance and third-party security practices.
• Collaborate with engineering and QA teams to implement security best practices throughout SDLC.
• Maintain expertise in HTTP, HTTPS, SSL/TLS, and SFTP protocols for secure communication and file transfer.
• Keep up with security trends, technologies, and emerging threats.

Required Skills & Qualifications

• Bachelors in Computer Science, Information Security, or relevant field (or equivalent experience).
• 5-7 years of application security assessment experience.
• Hands-on with SAST (e.g., SonarQube, Fortify) and DAST (e.g., Burp Suite, OWASP ZAP) tools.
• Penetration testing skills with real-world scenario simulation.
• Understanding of security protocols: HTTP, HTTPS, SSL/TLS, SFTP.
• Familiarity with OWASP Top 10, vulnerability management, and security frameworks.
• Analytical and communication skills.

Preferred Qualifications

• Security certifications (e.g., OSCP, CEH, CISSP, GIAC).
• Knowledge of cloud security (AWS, Azure, GCP).
• Exposure to DevSecOps and CI/CD integration for security.