Cloud Application Security Analyst

Akumen, Inc. is seeking an experienced Cloud Application Security Analyst to support the security of mission-critical web, mobile, API, and cloud-based applications. This role partners with software engineering, DevOps, quality assurance, infrastructure, and cybersecurity teams to identify vulnerabilities, integrate security controls into the software development lifecycle, and strengthen secure engineering practices across the organization. 

Position Overview:

The Cloud Application Security Analyst performs application security testing, secure design and code reviews, vulnerability triage, threat modeling, and cloud security configuration support. The successful candidate will apply Zero Trust and defense-in-depth principles, automate security validation within CI/CD pipelines, and help development teams remediate application and cloud security risks before production deployment. 

Key Responsibilities:

• Perform static application security testing (SAST), dynamic application security testing (DAST), and targeted manual security reviews for web and mobile applications.
• Review source code, APIs, application architectures, and cloud designs to identify security weaknesses before production release.
• Triage, prioritize, document, and support remediation of vulnerabilities, including issues aligned with the OWASP Top 10.
• Integrate automated security scanning and validation into CI/CD pipelines using platforms such as GitHub, GitLab, or Jenkins.
• Conduct threat modeling for new features, applications, APIs, and microservices, and maintain supporting security evidence and diagrams.
• Protect public-facing applications, internal services, APIs, and cloud resources through appropriate network security controls, segmentation, traffic inspection, and secure configuration.
• Deploy and manage cloud networking and security controls using Terraform, Bicep, ARM templates, or comparable Infrastructure as Code tools.
• Maintain repeatable secure configuration templates, technical baselines, controlled changes, and automated validation procedures.
• Partner with application, cloud, infrastructure, QA, and engineering teams to eliminate unnecessary exposure and overly permissive configurations.
• Research emerging application-layer and cloud threats, update internal security guidance, and promote secure coding and DevSecOps practices. 

Minimum Qualifications:

• Bachelor's degree in Information Technology, Computer Science, Cybersecurity, Engineering, a related discipline, or equivalent relevant experience.
• At least three years of experience in network engineering, cloud networking, network security, application security, or cloud security infrastructure support.
• Demonstrated knowledge of the OWASP Top 10, web application architecture, HTTP, APIs, REST, and GraphQL.
• Hands-on experience with SAST/DAST tools, vulnerability triage, manual code review, and secure SDLC or CI/CD workflows.
• Working knowledge of at least one programming or scripting language, such as Python, JavaScript, Java, or C#, with strong analytical, troubleshooting, communication, and cross-functional collaboration skills. 

Preferred Qualifications:

• Hands-on experience securing cloud environments in Amazon Web Services (AWS), Microsoft Azure, or Google Cloud Platform (GCP).
• Experience with container and orchestration security, including Docker and Kubernetes.
• Experience using Infrastructure as Code tools such as Terraform, Bicep, or ARM templates to deploy and validate security controls.
• Experience configuring enterprise or cloud-native firewalls, integrating third-party network security appliances, and troubleshooting complex cloud connectivity, application, firewall, and API issues.
• Relevant certifications such as Certified Secure Software Lifecycle Professional (CSSLP), CompTIA Security+, or an ethical hacking certification. 

Clearance Requirement:

• Active Secret security clearance or higher.