Application Security Analyst

Senior Application Security AnalystThe Senior Application Security Analyst is an integral part of the Application Security Team. He/she will assist in protecting applications, data, and systems by reducing security risks in custom and third-party software applications. The candidate should have excellent understanding of application security weaknesses for various technologies including web applications, web services, mobile applications, multi-tier applications and databases. Strong knowledge of OWASP Top 10 and SANS TOP 25 vulnerabilities and remediation practices associated with each category is required. The expert should be able to use manual techniques and automated tools to analyze applications and source code to identify vulnerabilities, triage results, and provide mitigation plans for discovered risks.Major Job Responsibilities:Use automated tools to perform application security tests and analyze source code to identify vulnerabilities, triage results, and provide mitigation plans for discovered risks.Have strong understanding of the security risks of findings, including ability to describe attack methods, acceptable mitigations, and to describe how inadequate mitigation methods do not remove security risk.Handle complex issues that may get in the way of quickly and successfully completing the testing engagement. Highly skilled in responding to inquiries from application teams for explanation or verification.Operationally be responsible for appropriately onboard/off board applications into security test tools to drive system and application security test. Support the testing effort and contribute to the creation or improvement of the testing processes.Minimum Education: Undergraduate degree or 6+ years of related experienceJob Related Experience: 3- 5 yearsRequired Skills / Background:Must have significant experience reviewing automated tool application source code security test results to identify vulnerabilities, triage results, and provide mitigation plans for true findings.Expert ability to manually test applications automated scan tools cannot appropriately test and able to validate or demo if a flaw is false positive or not.Advance understanding of application security weaknesses for various technologies including web applications, web services, databases, web/app servers, mobile apps and multi-tier apps.Strong understanding of information security concepts.Knowledge of web application security testing tools such as WhiteHat Sentinel, Veracode, Burp Suite, OWASP ZAP, AppScan, etc.Application/software programming experience is required.Must work closely and professionally with business partners, identify and solve issues in a timely manner.Communicate effectively and be a positive contributor to the enterprise security team.Desired Skills / Background:Advance understanding of various application development principles with a focus on Agile software development.Subject Matter Expertise (SME) in at least one programming language (e.g JAVA,.NET, Python, etc.) and excellent ability to review security test results and explain mitigation controls.