Note: The job is a remote job and is open to candidates in USA. The company is a major firm seeking an Application Security Vulnerability Analyst to assess application security findings and organizational risk. The role involves analyzing vulnerabilities, translating technical findings into actionable guidance, coordinating remediation with development and technology teams, and supporting application security operations.
Responsibilities
- Review vulnerabilities identified through AI-based SAST, SCA, and related application security tools
- Evaluate vulnerabilities beyond vendor-assigned severity scores by considering: Exploitability, Exposure, Attack paths, Business impact, Compensating controls, Application context
- Distinguish between theoretical findings and vulnerabilities that present realistic risks
- Validate vulnerability classifications and severity recommendations
- Identify false positives, duplicate findings, and opportunities for risk-based prioritization
- Ability to utilize AI to develop prompts to increase confidence in finding credibility and reduce false positives
- Assess vulnerability trends and recurring development patterns requiring broader corrective action. These responsibilities align with Security Assurance practices for prioritizing realistic risks rather than relying solely on finding volume or scanner output
- Explain findings clearly to developers, architects, technology owners, and business stakeholders
- Provide actionable remediation guidance and secure coding recommendations
- Assist application teams in understanding root causes and recommended fixes
- Partner with developers and technology owners to establish remediation plans
- Track remediation progress and follow up to ensure issues are resolved within the firms defined SLAs
- Escalate aging findings and remediation blockers as appropriate
- Support validation of completed remediation activities and closure recommendations
- Remediation coordination and driving vulnerabilities through closure is a core expectation within the firms vulnerability management operating model
- Support vulnerability triage activities across multiple application security tools
- Participate in vulnerability review sessions and remediation discussions
- Contribute to documentation, procedures, and process improvements
- Identify opportunities to improve consistency, efficiency, and quality in vulnerability review processes
- Assist with application security reporting and stakeholder communications
- Maintain accurate documentation of risk decisions, remediation guidance, and disposition rationale
Skills
- More than three years of experience in Application Security, Vulnerability Management, Security Risk Management, or a related cybersecurity discipline
- Strong understanding of: OWASP Top 10, Common software security weaknesses (CWEs), Software vulnerability management practices, Secure software development lifecycle (SSDLC), Exploit Prediction Scoring System (EPSS)
- Experience interpreting and validating findings from application security tools
- Experience using AI Based Security Tools
- Ability to evaluate findings in the context of exploitability, exposure, and business risk rather than relying solely on CVSS scores
- Experience working directly with development teams to remediate vulnerabilities
- Strong written and verbal communication skills with the ability to translate technical findings into business-relevant language
- Strong organizational skills with the ability to manage multiple workstreams and remediation efforts simultaneously
- Demonstrated ability to work independently and drive outcomes with limited supervision
- Experience reviewing or working with applications developed in one or more of the following languages: Java, TypeScript, JavaScript, C#, Python, Go, Node.js
- The ideal candidate must be capable of working on Eastern Standard Time
- The ideal candidate should also possess a green card or be of citizenship. No Visa entanglements and no H1-B holding company submittals
- Experience with one or more of the following is preferred: SAST tools (SonarQube, Snyk Code, Checkmarx, Veracode, GitHub Advanced Security, etc.)
- SCA tools and dependency risk analysis
- CI/CD security integration
- Secure coding reviews
Benefits
- Remote work arrangement
- Six month plus opportunity
Company Overview