Senior Application Security Analyst

Job Title: Senior Application Security Analyst
Location: Lafayette, Louisiana
Type: Full-time
Work Model: Hybrid – onsite and remote

Responsibilities

• Conduct manual application penetration testing across web applications, APIs, and backend services.
• Perform detailed secure code reviews to identify vulnerabilities and insecure coding practices.
• Identify and validate vulnerabilities using Burp Suite, OWASP ZAP, proxy tools, fuzzers, scanners, and manual testing techniques.
• Assess vulnerabilities based on exploitability, technical impact, and business risk.
• Recommend practical and prioritized remediation strategies to engineering teams.
• Apply OWASP security principles, secure coding practices, and industry standard application security controls.
• Produce detailed security assessment reports covering testing scope, methodology, findings, evidence, root cause, impact, and remediation.
• Clearly communicate technical security findings to both technical and non-technical stakeholders.
• Collaborate with development, security, and product teams to strengthen application security.

Requirements

• 6+ years of application security, penetration testing, or related cybersecurity experience.
• Strong hands-on experience with manual application penetration testing of web applications and APIs.
• Strong experience performing manual secure code reviews and identifying insecure coding practices.
• Advanced knowledge of OWASP Top 10, common application vulnerabilities, exploitation techniques, and remediation practices.
• Hands-on experience with Burp Suite, OWASP ZAP, web proxies, fuzzing tools, and vulnerability scanners.
• Ability to evaluate vulnerability severity based on exploitability, impact, and business risk.
• Familiarity with API security, authentication, authorization, session management, input validation, and other common application security controls.
• Experience reviewing source code in at least one modern programming language such as Java, Python, JavaScript/TypeScript, or C#.
• Strong technical writing skills for documenting security findings, evidence, root causes, and remediation recommendations.
• Strong verbal communication skills with the ability to explain security risks to developers and non-technical stakeholders.
• Experience working with modern application architectures and software development teams.
• Experience with AWS hosted applications and cloud security concepts is preferred.
• Previous hands-on software development experience is a plus.
• Educational Requirements: Bachelor's degree in Cybersecurity, Computer Science, Information Systems, or a related technical field.
• Relevant security certifications such as OSWE, GWAPT, GPEN, or CSSLP are beneficial but not required unless specified by the client.