Senior Application Security Analyst

Job Title: Senior Application Security Analyst
Location: Lafayette, Louisiana
Type: Full-time
Work Model: Hybrid – onsite and remote

Responsibilities

• Conduct manual application penetration testing across web applications, APIs, and backend services.
• Perform detailed secure code reviews to identify vulnerabilities and insecure coding practices.
• Identify and validate vulnerabilities using Burp Suite, OWASP ZAP, proxy tools, fuzzers, scanners, and manual testing techniques.
• Assess vulnerabilities based on exploitability, technical impact, and business risk.
• Recommend practical and prioritized remediation strategies to engineering teams.
• Apply OWASP security principles, secure coding practices, and industry standard application security controls.
• Produce detailed security assessment reports covering testing scope, methodology, findings, evidence, root cause, impact, and remediation.
• Clearly communicate technical security findings to both technical and non-technical stakeholders.
• Collaborate with development, security, and product teams to strengthen application security.

Requirements

• 6+ years of application security, penetration testing, or related cybersecurity experience.
• Strong hands-on experience with manual application penetration testing of web applications and APIs.
• Strong experience performing manual secure code reviews and identifying insecure coding practices.
• Advanced knowledge of OWASP Top 10, common application vulnerabilities, exploitation techniques, and remediation practices.
• Hands-on experience with Burp Suite, OWASP ZAP, web proxies, fuzzing tools, and vulnerability scanners.
• Ability to evaluate vulnerability severity based on exploitability, impact, and business risk.
• Familiarity with API security, authentication, authorization, session management, input validation, and other common application security controls.
• Experience reviewing source code in at least one modern programming language such as Java, Python, JavaScript/TypeScript, or C#.
• Strong technical writing skills for documenting security findings, evidence, root causes, and remediation recommendations.
• Strong verbal communication skills with the ability to explain security risks to developers and non-technical stakeholders.
• Experience working with modern application architectures and software development teams.
• Experience with AWS hosted applications and cloud security concepts is preferred.
• Previous hands-on software development experience is a plus.
• Educational Requirements: Bachelor's degree in Cybersecurity, Computer Science, Information Systems, or a related technical field.
• Relevant security certifications such as OSWE, GWAPT, GPEN, or CSSLP are beneficial but not required unless specified by the client.

System One, and its subsidiaries including Mountain Ltd., are leaders in delivering outsourced services and workforce solutions across North America. We help clients get work done more efficiently and economically, without compromising quality. System One not only serves as a valued partner for our clients, but we offer eligible employees health and welfare benefits coverage options including medical, dental, vision, spending accounts, life insurance, voluntary plans, as well as participation in a 401(k) plan.

System One is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, age, national origin, disability, family care or medical leave status, genetic information, veteran status, marital status, or any other characteristic protected by applicable federal, state, or local law.

#LI-
Ref: #404-IT Pittsburgh