Note: The job is a remote job and is open to candidates in USA. Software Guidance & Assistance, Inc. (SGA) is a technology and resource solutions provider serving clients through IT consulting and staffing engagements. The company is seeking an Application Security Vulnerability Analyst to review, validate, prioritize, and manage application security vulnerabilities, using AI-assisted tools and risk-based analysis. The role partners with development and technology teams to provide remediation guidance, track findings through closure, and improve application security processes.
Responsibilities
- Review vulnerabilities identified through AI-based SAST, SCA, and related application security tools
- Evaluate vulnerabilities beyond vendor-assigned severity scores by considering exploitability, exposure, attack paths, business impact, compensating controls, and application context
- Distinguish between theoretical findings and vulnerabilities that present realistic application and business risk
- Validate vulnerability classifications and severity recommendations
- Identify false positives, duplicate findings, and opportunities for risk-based prioritization
- Utilize AI and effective prompting techniques to increase confidence in findings and reduce false positives
- Assess vulnerability trends and recurring development patterns that may require broader corrective action
- Explain application security findings clearly to developers, architects, technology owners, and business stakeholders
- Provide actionable remediation guidance and secure coding recommendations
- Assist application teams in understanding root causes and recommended fixes
- Partner with developers and technology owners to establish remediation plans and drive findings to closure
- Track remediation progress and ensure vulnerabilities are addressed within defined SLAs
- Escalate aging findings and remediation blockers as appropriate
- Validate completed remediation activities and make closure recommendations
- Support vulnerability triage activities across multiple application security tools
- Participate in vulnerability review sessions and remediation discussions
- Maintain accurate documentation of risk decisions, remediation guidance, and disposition rationale
- Contribute to application security procedures, reporting, and process improvements
Skills
- * 3+ years of experience in Application Security, Vulnerability Management, Security Risk Management, or a related cybersecurity discipline
- * Strong understanding of application security and vulnerability management, including: + OWASP Top 10 + Common Weakness Enumeration (CWE) + Secure Software Development Lifecycle (SSDLC) + Exploit Prediction Scoring System (EPSS) + CVE/CVSS concepts
- * Experience reviewing and validating findings generated by SAST, SCA, or related application security tools
- * Ability to evaluate vulnerabilities based on actual exploitability, exposure, application context, and business risk rather than relying solely on CVSS scores
- * Experience identifying false positives and validating vulnerability classifications and severity
- * Experience working directly with development teams to remediate application vulnerabilities
- * Ability to understand application security findings involving one or more modern enterprise development languages, including Java, TypeScript, JavaScript, C#, Python, Go, or Node.js
- * Experience using AI-based security tools or AI-assisted security analysis
- * Ability to provide developers with actionable remediation and secure coding guidance
- * Strong written and verbal communication skills with the ability to translate technical findings into clear, business-relevant language
- * Strong organizational skills and the ability to manage multiple remediation efforts simultaneously
- * Demonstrated ability to work independently and drive issues through resolution
- This is a remote role; candidates must work EST business hours
- * Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related field preferred, or equivalent relevant professional experience
- * Experience with SAST tools such as SonarQube, Snyk Code, Checkmarx, Veracode, GitHub Advanced Security, or similar
- * Experience with SCA tools and software dependency risk analysis
- * Application security testing and secure code review experience
- * CI/CD security integration experience
- * Experience with Claude Code or similar AI-assisted security/development tools
- * Understanding of software architecture and common web application attack patterns
- * Working knowledge of cloud-native applications and APIs
- * Familiarity with enterprise vulnerability management and remediation tracking workflows
- * Security certifications such as Security+, CSSLP, GWEB, GWAPT, CySA+, OSWE, or similar
- * Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related field preferred, or equivalent relevant professional experience
Benefits
- This is a remote role; candidates must work EST business hours.
Company Overview
Company H1B Sponsorship