Application Security Analyst

Join Stellantis in Auburn Hills, MI (onsite) and help strengthen software security across the application lifecycle. This Application Security role focuses on identifying and mitigating vulnerabilities through a Shift Left approach and practical DevSecOps integration, with clear ownership of testing, remediation to closure, and Web Application Firewall (WAF) leadership.

What you’ll do

• Perform application security testing across the SDLC using SAST, DAST, IAST, mobile security, and dynamic testing
• Analyze vulnerabilities, recommend secure coding fixes, and support development teams with clear, actionable guidance
• Demonstrate vulnerabilities to development teams and help drive remediation efforts to closure
• Work inside CI/CD pipelines using Jenkins, GitLab, GitHub Actions, and TeamCity
• Use security testing tools including Checkmarx, GitHub Advanced Security, and Burp Suite within development workflows
• Integrate security controls into development workflows and align execution to defined application security policies, controls, and standards
• Lead Web Application Firewall (WAF) deployment for both new and existing applications
• Partner with development, platform, and supplier teams to support security outcomes
• Conduct security assessments using standard tooling and produce reporting that tracks risks, milestones, deliverables, and status updates
• Recommend application security strategies based on application risk posture
• Train teams on secure coding and application security practices, including developing training materials

What you’ll need

• Bachelor’s degree in Computer Science, Information Technology, or related field
• 3+ years of hands-on experience in application security, security testing, and DevSecOps
• Strong understanding of application architectures (web, mobile, APIs) and software development methodologies (Agile, SDLC)
• Strong understanding of modern programming languages: Java, C#, Python
• Experience performing and interpreting results from SAST, DAST, IAST, SCA, and mobile security testing
• Hands-on secure code review experience in common languages (Java, C#, Python preferred)
• Prior application development background, including compiled code, web applications/services, and mobile app development
• Knowledge of security frameworks and standards: NIST, ISO 27001
• Knowledge of security frameworks and standards: NIST SSDF or similar secure development frameworks
• Strong understanding of OWASP Top 10 vulnerabilities and mitigation techniques
• Strong understanding of common attack vectors: web exploits, DDoS, bot attacks
• WAF technology experience: Akamai, Cloudflare, AWS WAF, Azure Front Door
• Familiarity with cloud and modern environments: AWS, Azure, GCP and Containers (Docker, Kubernetes)
• Working knowledge of Java, JavaScript, SQL, HTML
• Working knowledge of scripting languages (Python, Bash preferred)
• Strong analytical, problem-solving, and communication skills, including the ability to explain technical risks to non-technical audiences
• Experience writing security reports and documentation
• Ability to work independently and cross-functionally
• Industry certifications: GIAC GWEB, ISC2 CSSLP, EC-Council CASE, or equivalent AppSec certifications

Benefits

• Medical, dental, vision, and prescription drug coverage
• 17+ paid holidays, including shut-down from December 24th through New Years Day every year
• Vacation, float & wellbeing days
• Sick time
• Fully paid parental leave
• Employer match on contributions to your 401k, Roth, and Catch-Up plans
• An employer contribution, even if you don’t contribute
• Included and optional disability, life, and other insurance programs
• Company Vehicle Lease Program
• Family Building Benefit (fertility and infertility treatments, adoption services, and gestational surrogacy)
• Tuition reimbursement
• Student loan refinancing programs
• 18 paid volunteer hours each year