Application Security Vulnerability Analyst

Contract

Hudson Yards, NYC/Remote

Key Responsibilities

Vulnerability Analysis & Risk Assessment

• Review vulnerabilities identified through AI-based SAST, SCA, and related application security tools.
• Evaluate vulnerabilities beyond vendor-assigned severity scores by considering:
• Exploitability
• Exposure
• Attack paths
• Business impact
• Compensating controls
• Application context
• Distinguish between theoretical findings and vulnerabilities that present realistic risk to Guardian.
• Validate vulnerability classifications and severity recommendations.
• Identify false positives, duplicate findings, and opportunities for risk-based prioritization.
• Ability to utilize AI to develop prompts to increase confidence in finding credibility and reduce false positives
• Assess vulnerability trends and recurring development patterns requiring broader corrective action. These responsibilities align with Security Assurance practices for prioritizing realistic risks rather than relying solely on finding volume or scanner output

Developer Engagement & Remediation Coordination

• Explain findings clearly to developers, architects, technology owners, and business stakeholders.
• Provide actionable remediation guidance and secure coding recommendations.
• Assist application teams in understanding root causes and recommended fixes.
• Partner with developers and technology owners to establish remediation plans.
• Track remediation progress and follow up to ensure issues are resolved within Guardian-defined SLAs.
• Escalate aging findings and remediation blockers as appropriate.
• Support validation of completed remediation activities and closure recommendations. Remediation coordination and driving vulnerabilities through closure is a core expectation within Guardian's vulnerability management operating model.

Application Security Operations Support

• Support vulnerability triage activities across multiple application security tools.
• Participate in vulnerability review sessions and remediation discussions.
• Contribute to documentation, procedures, and process improvements.
• Identify opportunities to improve consistency, efficiency, and quality in vulnerability review processes.
• Assist with application security reporting and stakeholder communications.
• Maintain accurate documentation of risk decisions, remediation guidance, and disposition rationale. Security Assurance materials emphasize operational clarity, documentation, and repeatable processes that drive work to closure.

Required Qualifications

• 3+ years of experience in Application Security, Vulnerability Management, Security Risk Management, or a related cybersecurity discipline.
• Strong understanding of:
• OWASP Top 10
• Common software security weaknesses (CWEs)
• Software vulnerability management practices
• Secure software development lifecycle (SSDLC)
• Exploit Prediction Scoring System (EPSS)
• Experience interpreting and validating findings from application security tools.
• Experience using AI Based Security Tools.
• Ability to evaluate findings in the context of exploitability, exposure, and business risk rather than relying solely on CVSS scores.
• Experience working directly with development teams to remediate vulnerabilities.
• Strong written and verbal communication skills with the ability to translate technical findings into business-relevant language.
• Strong organizational skills with the ability to manage multiple workstreams and remediation efforts simultaneously.
• Demonstrated ability to work independently and drive outcomes with limited supervision. These qualifications align closely with Security Assurance expectations for reviewing technical findings, making risk-based decisions, and influencing remediation outcomes.

Required Technical Skills

Experience reviewing or working with applications developed in one or more of the following languages:

• Java
• TypeScript
• JavaScript
• C#
• Python
• Go
• Node.js
• Other modern enterprise development languages
• Experience with one or more of the following is preferred:
• SAST tools (SonarQube, Snyk Code, Checkmarx, Veracode, GitHub Advanced Security, etc.)
• SCA tools and dependency risk analysis
• CI/CD security integration
• Secure coding reviews

Preferred Qualifications

• Application security testing experience.
• Secure code review experience.
• Experience using Claude Code or related AI security testing tools.
• Understanding of software architecture and common web application attack patterns.
• Working knowledge of cloud-native applications and APIs.
• Familiarity with vulnerability management processes and remediation tracking workflows.
• Security certifications such as Security+, CSSLP, GWEB, GWAPT, CySA+, OSWE, GWAPT, or similar.