Find Jobs
Find Jobs Near You – Available Work in Your Location
Senior Application Security Analyst DevSecOps SAST DAST SCA
Career Insights for Vulnerability Analyst / Penetration Tester
See where this job fits in the broader career landscape. Knowing your career path helps you see what's possible from here.
Scorecard
Based on Michigan data
Review key factors to help you decide if this role fits your goals. How is this calculated?
What they do
A Vulnerability Analyst or Penetration Tester probes for and exploits security vulnerabilities in web-based applications, networks and systems. Penetration Tests are designed to achieve a specific, attacker-simulated goal and should be requested by customers who are already at their desired security posture. A typical goal could be to access the contents of the prized customer database on the internal network, or to modify a record in an HR system. Vulnerability Assessments are designed to yield a prioritized list of vulnerabilities and are generally for clients who already understand they are not where they want to be in terms of security. The customer already knows they have issues and simply need help identifying and prioritizing them.
$103,889 / year median in Michigan
+4% projected growth
Job Description
- Only qualified IT Security Auditor candidates located near the Dimondale MI area to be considered due to the position requiring an onsite presence
- REQUIRED EXPERIENCE KNOWLEDGE ABILITIES AND SKILLS
- Experience with Application Security scanning tools (SAST
DAST SCA ASOC
Container/Cloud) a must
- HTTP Request/Response headers for web and Restful API calls
- Ability to explain in detail any of the OWASP top 10 vulnerabilities
- Cross Site Scripting Injection attacks
SSRF CSRF XML
entity etc
- Minimum of 5+ years of total IT related experience
- Implementing/utilizing Federal Industry and Open-Source Security Guidance and Secure Coding Practices (OWASP Top 10 SANS
CERT CWE
Top 25 Critical Security Controls Cloud Security Alliance SafeCode etc) (3+ years)
- Both compiled and interpreted languages such as Angular React Nodejs Java Spring Boot IBM WebSphere App server Oracle JBoss NET stacks (3+ years)
- Networking infrastructure secure application development and security automation (DevSecOps) (3+ years)
- Hands-on knowledge building and deploying secure complex distributed web and mobile applications (3+ years)
- Chrome/Firefox/Edge Development tools to see the request/response headers
PREFERRED EXPERIENCE KNOWLEDGE ABILITIES AND SKILLS
- Experience with Coverity BlackDuck SRM Fortify a plus
- API Security
- JWT•OAUTH/OIDC/PKCE•Web API replay attacks•High-level understanding of containers•Cloud development experience (Azure AWS GCP)JOB
RESPONSIBILITIES
- Senior Full Stack Application Development Security Auditor who is passionate about designing and building secure platforms and applications through Dynamic Static and Software Composition Analysis assessments
- This position is not a member of the Security Operations Center rather it is dedicated to working with software development teams on secure coding practices
- The ideal candidate will feel comfortable working with both front-end back-end and cloud-based application developers
- Partnering with distributed teams to help transform the way systems are built secured authorized and securely operated for continuous compliance and risk mitigation
- Specifically this candidate will help lead efforts to implement security patterns and practices with orchestration and automation tools that automate the secure configuration verification compliance and authorization of systems and their development
- They will be a key member of a team tasked with maturing the organization's secure software development practices