Application Security Consultant - DAST

Join MassMutual to advance application security initiatives with a focus on dynamic application security testing (DAST) across web applications and APIs.

Responsibilities

• Own and advance the dynamic application security testing (DAST) program, including selecting, deploying, configuring, and maintaining DAST tooling across the web application and API estate.
• Design and run authenticated dynamic scans for complex applications, including session handling, multi-step workflows, single-page applications, and REST and GraphQL APIs.
• Integrate DAST into CI/CD pipelines and pre-production environments to enable continuous dynamic testing, and define release-gating thresholds.
• Triage, validate, and tune DAST results by reducing false positives, manually confirming exploitability, and converting findings into remediation guidance for development teams.
• Use manual security techniques alongside automated dynamic testing to identify, risk-assess, and prioritize vulnerabilities (including OWASP Top 10 issues) that scanners may miss.
• Perform in-depth application security assessments, including vulnerability scanning and code review.
• Conduct detailed threat modeling to identify attack vectors and weaknesses, then use results to target dynamic test coverage at the highest risk areas.
• Partner with security architects to design secure application architectures aligned to industry best practices and ensure secure coding practices and security controls are embedded in designs.
• Collaborate with the SDLC Council to develop and maintain secure coding standards that support developer workflow adoption.
• Work with DevOps teams to implement security controls inside CI/CD pipelines for automated, seamless deployment of secure code.
• Maintain the application security testing toolchain alongside DAST, including SAST and software composition analysis (SCA).
• Evaluate third-party software and APIs for security compliance, including dynamic testing of externally sourced components where appropriate.
• Support incident response for application security events with rapid identification and mitigation guidance.
• Ensure compliance with applicable security regulations, frameworks, and industry standards.
• Use reporting tools to communicate vulnerability and code-defect risk through metrics (KPIs, KRIs, OKRs) for risk-based prioritization by team leaders and executive leadership.
• Educate developers and stakeholders on secure coding practices and on interpreting and acting on dynamic test results.
• Stay current on security threats, vulnerabilities, and industry trends, applying updates to improve the security strategy.

Requirements

• Bachelor's Degree
• 8+ years of experience in application security, penetration testing, or secure software development

Technologies

• DAST, Burp Suite, OWASP ZAP, Invicti, Acunetix, StackHawk
• REST, GraphQL, SAST, SCA, IAST
• OWASP Top 10
• CEH, OSCP, CISSP, GWAPT, SANS/GIAC, CompTIA, ISACA, ISC2
• DevSecOps, CI/CD
• AWS, Azure, GCP
• Mobile security
• Infrastructure as code, Docker, Kubernetes, Terraform
• GitHub Actions, Jenkins, AWS CloudFormation
• Secrets managers, encryption, authentication, access control
• SOC 2
• Java, JavaScript, C/C++/C#, Python, Maven, Gradle
• Container images, threat modeling

Benefits

• Medical, dental, and generous vacation time
• 401(k) with up to 10% total 401(k) benefit (5% company match and 5% annual contribution)
• Three paid days for volunteering
• $1,250 annual Well-Being Wallet
• Up to 320 hours of caregiver leave
• Personalized mental health solutions, on-site and virtual health coaching, and reimbursement up to $1,250 per year for eligible expenses
• Generous maternity and parental leaves
• Bereavement leave
• Bereavement leave to mourn the loss of a loved one
• MassMutual Foundation matches employee donation dollars to eligible nonprofit organizations up to $5,000 annually
• Qualified Commuter Program with before-tax dollars for eligible workplace commuting expenses

How we work

• Flexible workplace approach combines in-person collaboration and remote flexibility
• Hybrid model: employees come in at least three days per week to campus settings
• Remote Fridays, company-wide remote weeks, and a bank of flexible remote weeks throughout the year

Minimum qualifications

• Bachelor's Degree
• 8+ years of experience in application security, penetration testing, or secure software development

Impact

• Key responsibilities focus on ensuring applications are resilient against emerging threats and reducing financial and reputational damage from security incidents

The team

• Application Security team keeps MassMutual software applications secure through rigorous assessment and proactive development team engagements
• Works closely with security architects, DevOps engineers, and software developers
• Emphasis on identifying and verifying vulnerabilities, including hands-on dynamic testing of running applications and APIs, and helping development teams remediate
• Backgrounds span software engineering to red teaming, with values centered on continuous learning, innovation, and collaboration