Application Security Analyst

This role focuses on identifying, analyzing, and mitigating application security vulnerabilities throughout the SDLC. It supports a broader “Shift Left” cybersecurity strategy, ensuring security is integrated early in development and reinforced through DevSecOps practices. Key Responsibilities Application Security & Testing Perform security testing: SAST, DAST, IAST, mobile security, and dynamic testing Analyze vulnerabilities and recommend secure coding fixes Demonstrate vulnerabilities to development teams Drive remediation efforts to closure DevSecOps & Tooling Work within CI/CD pipelines using tools such as: Jenkins, GitLab, GitHub Actions, TeamCity Checkmarx, GitHub Advanced Security, Burp Suite Integrate security controls into development workflows WAF & Security Controls Lead Web Application Firewall (WAF) deployment for new and existing apps Implement application security policies, controls, and standards Collaboration & Enablement Partner with development, platform, and supplier teams Provide clear remediation guidance Train teams on secure coding and application security practices Develop training materials Assessment & Reporting Conduct security assessments using standard tools Track and report: Risks Milestones Deliverables Status updates Recommend strategies based on application risk posture This role is based in Auburn Hills, MI and is required to be on-site in our HQ building 5 days per week. Basic Qualifications Bachelor’s degree in Computer Science, Information Technology, or related field 3+ years of hands-on experience in application security, security testing, and DevSecOps Strong understanding of: Application architectures (web, mobile, APIs) Software development methodologies (Agile, SDLC) Modern programming languages (Java, C#, Python) Experience performing and interpreting results from: SAST, DAST, IAST, SCA, and mobile security testing tools Hands-on experience with secure code review in common languages (Java, C#, Python preferred) Prior background in application development, including: Compiled code Web applications / services Mobile app development Knowledge of security frameworks and standards:

NIST, ISO 27001

NIST SSDF or similar secure development frameworks Strong understanding of: OWASP Top 10 vulnerabilities and mitigation techniques Common attack vectors (web exploits, DDoS, bot attacks) Experience with WAF technologies: Akamai, Cloudflare, AWS WAF, Azure Front Door Familiarity with cloud platforms and modern environments: AWS, Azure, GCP Containers (Docker, Kubernetes) Working knowledge of: Programming/scripting: Java, JavaScript, SQL, HTML Scripting languages (Python, Bash preferred) Strong analytical, problem-solving, and communication skills Ability to explain technical risks to non-technical audiences Experience writing security reports and documentation Ability to work independently and cross-functionally Preferred Qualifications Industry certifications:

GIAC GWEB

ISC2 CSSLP

EC-Council CASE Or equivalent AppSec certifications #J-18808-Ljbffr Stellantis