Application Security Analyst

Hexaware Technologies is seeking an Application Security Analyst in Alpharetta, Georgia, United States (onsite). In this role, you will help protect modern software by finding application security risks early, validating remediation, and communicating priorities clearly to both technical and non-technical stakeholders. The position focuses on hands-on security assessments across web applications, APIs, microservices, and backend systems, with an emphasis on actionable reporting and repeatable testing methods.

What you’ll do

• Perform manual application security assessments across web applications, APIs, microservices, and backend systems.
• Run application penetration testing to identify vulnerabilities, attack vectors, and exploitation opportunities.
• Conduct secure code reviews to uncover insecure coding practices and validate adherence to security standards.
• Assess application architectures and recommend security improvements throughout the Software Development Lifecycle (SDLC).
• Identify, validate, and prioritize vulnerabilities based on exploitability, business impact, and potential risk.
• Analyze security findings to determine root causes and support effective remediation.
• Partner with development teams to deliver remediation guidance and security best practices.
• Evaluate risks in modern application architectures, including cloud-native and API-driven environments.
• Use industry-standard testing tools, including Burp Suite, OWASP ZAP, security proxies, web application scanners, fuzzing tools, and API testing platforms.
• Validate fixes through re-testing and verification activities.
• Build repeatable testing methodologies and security assessment procedures.
• Create security assessment reports covering scope and methodology, technical findings with evidence, severity ratings, root cause analysis, business impact, and practical remediation recommendations.
• Present findings to technical and non-technical stakeholders, and communicate remediation priorities to developers, architects, project teams, and leadership.

What you bring

• Strong experience performing manual application security assessments and penetration testing.
• Deep understanding of common application vulnerabilities and attack techniques.
• Hands-on ability to identify and exploit application security weaknesses in web applications, APIs, and backend services.
• Strong understanding of secure design and secure development practices.
• Proven experience conducting manual source code reviews and identifying insecure coding practices.
• Experience reviewing code in one or more languages: Java, C#, Python, JavaScript/TypeScript, Go, Node.js.
• Strong knowledge of OWASP Top 10, OWASP ASVS, secure coding best practices, application security testing methodologies, and industry security controls and frameworks.
• Understanding of authentication, authorization, session management, encryption, and API security principles.
• Experience assessing vulnerability severity using industry-standard methodologies.
• Strong analytical and problem-solving skills.
• Excellent written and verbal communication skills.
• Ability to communicate effectively with developers, architects, project teams, and executive stakeholders.

Tools and technologies

• Burp Suite, OWASP ZAP, Security Proxies, Web Application Scanners, Fuzzing Tools, API Testing Platforms
• Java, C#, Python, JavaScript/TypeScript, Go, Node.js
• OWASP Top 10, OWASP ASVS

Preferred qualifications

• Previous software development experience.
• Familiarity with microservices, REST APIs, cloud-native applications, containerized environments, and DevSecOps practices.
• Experience working in Agile development environments.
• Exposure to CI/CD security testing and automation.
• Industry certifications such as GWAPT, GPEN, OSCP, CSSLP, CISSP, CEH.