Application Security Analyst

Description The Application Security Analyst will be responsible for working with the application development team to analyze application code vulnerabilities and be involved in running security scans, which include but are not limited to SAST, DAST, IAST, Mobile, and ad‑hoc dynamic testing. The Analyst will also play a role in extending WAF deployment for a large number of applications, and will help lead a major cybersecurity transformation initiative of "Shift left and Secure Early" as well as implement additional security controls in the SDLC. The role entails taking responsibility for analyzing security vulnerabilities and providing mitigation solutions to fix issues by writing secure code, providing guidance to application teams, and coordinating with cross‑functional teams across the platform. Key Responsibilities Hands‑on experience working with DevSecOps pipelines using CI/CD automation tools such as Jenkins, TeamCity, GitLab, GitHub Actions, Checkmarx, GitHub Advanced Security, BurpSuite, and open‑source tools. Implement application cyber security controls, policies, and standards developed by the Application Security Program. Lead deployment of WAF for existing and new applications. Ability to demonstrate security vulnerabilities to application teams. Drive application security issues to resolution. Provide clear guidance to application teams during vulnerability mitigation efforts. Conduct application security assessments using standard Stellantis application security tools. Collect and report status on application security assessments, including milestones, deliverables, timing, tasks, risk areas, and status. Categorize and recommend assessment strategies for existing and new application development. Coach development and supplier teams on application security. Develop user training material and conduct training sessions. This role is based in Auburn Hills, MI and requires on‑site presence in the HQ building five days per week. Qualifications Bachelor's degree in computer science, technology, or a related field. At least 3 years of application security analysis, testing, and DevSecOps experience. Understanding of application architectures, development methodologies, and programming languages. Problem‑solving skills and the ability to work independently and as part of a team. Technical writing and communication skills to articulate security risks and findings to both technical and non‑technical audiences. Hands‑on experience reviewing application security in secure code, preferred in Java, C#, Python, and other popular programming languages. Background experience with application development, including compiled code, mobile applications, website design, and web services. Hands‑on experience running SAST, DAST, IAST, SCA, and Mobile scans. Knowledge of security and compliance frameworks such as NIST and ISO. Understanding and experience in NIST SSDF or other secure software development frameworks. Knowledgeable in deployment of WAF tools such as Akamai, Cloudflare, Azure Front Door, and AWS WAF. Knowledge of the OWASP Top 10 and mitigation strategies for each. Knowledge of techniques for web attacks, DDoS attacks, and BOT attacks and management/mitigation controls. Experience with cloud platforms (AWS, Azure, GCP) and container frameworks. Knowledge of programming, scripting, and query languages such as Java, SQL, HTML, and JavaScript. Preferred experience in scripting languages. Preferred certifications: GIAC GWEB, ISC2 CSSLP, EC-Council CASE, or similar comparables. At Stellantis, we assess candidates based on qualifications, merit, and business needs. We welcome applications from all people without regard to sex, age, ethnicity, nationality, religion, sexual orientation, disability, or any characteristic protected by law. We believe that diverse teams reflect our identity as a global company, enabling us to better address the evolving needs of our customers and care for our future. #J-18808-Ljbffr Stellantis