Application Security Analyst

PNC Financial Services Group is hiring an Application Security Analyst within its Technology organization to help strengthen the organization’s overall security posture. In this in-office role, you will assess application security risks, investigate vulnerabilities and data security issues, and recommend corrective actions while advising on security procedures, products, and controls.

This position is based in one of the listed U.S. office locations, including Birmingham, AL (onsite), and also Denver, CO; Phoenix, AZ; Dallas, TX; Pittsburgh, PA or Cleveland, OH. The hiring range for the base salary is $75,000.00 to $137,500.00 per year, and the role is incentive eligible based on company, business, and/or individual performance.

What you’ll do

• Provide technical evaluation and analysis across application security activities, processes, and tools.
• Support work that improves PNC’s overall security posture, applying security concepts to review information, execute defined tasks, analyze requirements, review logs, and create documentation.
• Perform investigations related to data loss prevention and data manipulation, including coordination of related activities.
• Take actions to address or mitigate risks and vulnerabilities.
• Review and define controls, and participate in enforcement related to control security risks and threats (with additional control responsibility subject to manager discretion).
• Advise on more complex security procedures and products for clients, security administrators, and network operations.
• Conduct security assessments and other information security routines in a consistent manner.
• Investigate data security concerns and recommend corrective actions aligned to established guidelines.
• Share knowledge with staff to support repeatable security practices.

Qualifications

• Knowledge of common application security concepts and vulnerability types, such as OWASP Top 10, including the ability to learn how they apply in real-world systems.
• Exposure to the Software Development Lifecycle (SDLC), with interest in understanding where security fits into design, development, and testing.
• Ability to analyze information, follow defined security processes, and execute assigned security tasks with attention to detail.
• Strong analytical and problem-solving skills to identify potential risks and support remediation efforts under guidance.
• Effective communication skills to explain security findings, vulnerabilities, and risks clearly to developers, product managers, and non-security partners.
• Willingness to coach and educate partners on security processes and expectations.
• Ability to work independently and collaboratively within cross-functional teams.
• Familiarity with Agile delivery concepts such as Scrum and Kanban.
• Hands-on exposure to application security, secure coding concepts, or software development.
• Familiarity with security testing concepts and outputs (for example, vulnerability scanning results, SAST/DAST), and ability to learn tool usage on the job.
• Knowledge of security frameworks, standards, or best practices such as OWASP and NIST, or a strong interest in developing that knowledge.
• Cloud computing concepts or modern application architectures (such as APIs and microservices) are a plus.
• Entry-level or foundational security certifications (examples provided: Security+ and GIAC Fundamentals) or progress toward relevant certification.
• Demonstrated interest in application security through academic projects, personal learning, or prior roles.
• Strong documentation skills to create clear notes, assessments, and evidence to support security processes and controls.
• Typical role requirements include a Bachelors degree and 3+ years of relevant or direct industry experience (certifications are often desired; comparable combinations may be considered in lieu of a degree).
• No required certification(s), license(s), or language assessments are listed.

Technologies and frameworks

• OWASP Top 10, OWASP
• SDLC
• Scrum, Kanban
• SAST, DAST
• Vulnerability scanning
• NIST
• Security+, GIAC Fundamentals
• APIs, microservices

Benefits

• Medical/prescription drug coverage with a Health Savings Account feature
• Dental and vision options
• Employee and spouse/child life insurance
• Short and long-term disability protection
• 401(k) with PNC match
• Pension and stock purchase plans
• Dependent care reimbursement account
• Back-up child/elder care
• Adoption, surrogacy, and doula reimbursement
• Educational assistance, including select programs fully paid
• Robust wellness program with financial incentives
• Maternity and/or parental leave
• Up to 11 paid holidays each year
• 9 occasional absence days each year (unless otherwise required by law)
• Between 15 to 25 vacation days each year, depending on career level

Additional information

• Application window: expected to be posted for two business days from 11/05/2026, though it may be longer with business discretion.
• Accommodation requests: contact [email protected] with subject line containing “accommodation request,” including your name, the job ID, and preferred contact method; or call 877-968-7762 and say “Workday”.
• Equal employment opportunity: PNC provides equal employment opportunity regardless of protected characteristics as described in its EEO statement.
• California residents: refer to the California Consumer Privacy Act Privacy Notice for hiring practices information.
• Other notes: PNC is an in-office company. PNC will not provide sponsorship for employment visas or participate in STEM OPT for this position.