Application Security Analyst II

Application Security Analyst II supports Little Caesars’ application security program by identifying, assessing, and helping remediate software risks across the development lifecycle.

Responsibilities

• Perform application security assessments for new and existing applications, APIs, integrations, and supporting services.
• Conduct or coordinate application security testing, including SAST, DAST, SCA, API security testing, and manual validation as appropriate.
• Analyze security findings, validate risk and impact, reduce false positives, and partner with development teams to prioritize and remediate vulnerabilities.
• Participate in application threat modeling and secure design reviews to identify risks and recommend practical security controls before deployment.
• Define, document, communicate, and maintain application security requirements, standards, procedures, and supporting guidance.
• Partner with development and engineering teams to integrate security checks and guardrails into source code management and CI/CD pipelines.
• Provide consultative support on secure coding practices and application security topics, including authentication, authorization, session management, secrets management, data protection, and API security.
• Track application security risks, remediation plans, exceptions, and metrics; escalate material risks or overdue remediation through established governance processes.
• Support evaluation, implementation, administration, and continuous improvement of application security tools and processes.
• Contribute to security awareness and enablement by developing guidance and sharing actionable application security recommendations with technical teams.
• Participate in relevant project, change, architecture, and security governance reviews as needed.
• Maintain awareness of emerging application security threats, vulnerabilities, attack techniques, and industry practices.

Requirements

• Bachelor’s degree in Computer Science, Computer Engineering, Information Technology, Cyber Security, or a related technical field.
• Minimum four (4) years of relevant industry experience may be considered in lieu of a formal degree.
• Minimum three (3) years of information technology experience, including at least one (1) year in information security, application development, application security, or a closely related discipline.
• Working knowledge of secure software development lifecycle practices and ability to apply security requirements within Agile or other development methodologies.
• Working knowledge of common application and API vulnerabilities, including the OWASP Top 10, with practical approaches for prevention and remediation.
• Experience with one or more application security testing approaches or technologies, such as SAST, DAST, SCA, API security testing, secrets scanning, or container security scanning.
• Ability to review and interpret application security findings, assess business and technical risk, and communicate clear remediation guidance to development and engineering teams.
• Understanding of secure coding concepts and application security controls, including authentication, authorization, input validation, session management, encryption, secrets management, logging, and error handling.
• Understanding of web technologies, APIs, cloud-hosted applications, source code management, and CI/CD concepts.
• Familiarity with vulnerability management, risk acceptance, exception handling, and remediation tracking processes.
• Strong analytical, problem-solving, documentation, and communication skills.

Technologies

• Static application security testing (SAST)
• Dynamic application security testing (DAST)
• Software composition analysis (SCA)
• API security testing
• Secrets scanning
• Container security scanning
• OWASP Top 10
• CI/CD
• Agile

What Will Make You Stand Out

• Hands-on experience with enterprise application security tools and developer security workflows.
• Experience integrating security testing into CI/CD pipelines and development platforms.
• Familiarity with one or more programming or scripting languages and the ability to understand application code.
• Familiarity with cloud-native application architectures, containers, microservices, and infrastructure as code.
• Application security or security-related certifications such as CSSLP, GIAC, CISSP, Security+, or comparable credentials.

Role Expectations and Core Competencies

• Collaborates effectively across teams, incorporates diverse perspectives, and contributes to shared objectives.
• Demonstrates customer orientation by considering customer needs and perspectives, building effective relationships, and supporting a positive customer experience.
• Defines problems, analyzes and interprets information, anticipates obstacles, and develops solutions using sound judgment and data; communicates findings clearly to technical and non-technical audiences.
• Shows passion for information security and service excellence.
• Communicates clearly, accurately, and effectively in verbal and written formats, adapting information appropriately.
• Works independently with general direction, prioritizes competing responsibilities, manages multiple deadlines, and drives assigned work through completion.

Location: Detroit, MI (onsite)