Cloud Application Security Analyst

Akumen, Inc. is seeking a Cloud Application Security Analyst to help secure mission-critical web, mobile, API, and cloud-based applications in Washington, DC (onsite). In this role, you will support secure engineering and DevSecOps by performing application security testing, reviewing designs and code, triaging vulnerabilities, and helping strengthen cloud security configurations.

What you’ll do

• Run static application security testing (SAST), dynamic application security testing (DAST), and targeted manual security reviews for web and mobile applications.
• Assess source code, APIs, application architectures, and cloud designs to identify weaknesses prior to production release.
• Triaging, prioritizing, documenting, and supporting remediation of vulnerabilities, including issues aligned with the OWASP Top 10.
• Integrate automated security scanning and validation into CI/CD pipelines using platforms such as GitHub, GitLab, or Jenkins.
• Conduct threat modeling for new features, applications, APIs, and microservices, and maintain supporting security evidence and diagrams.
• Help protect public-facing applications, internal services, APIs, and cloud resources using network security controls, including segmentation, traffic inspection, and secure configurations.
• Deploy and manage cloud networking and security controls using Terraform, Bicep, ARM templates, or comparable Infrastructure as Code tooling.
• Maintain repeatable secure configuration templates, technical baselines, controlled changes, and automated validation procedures.
• Partner with application, cloud, infrastructure, QA, and engineering teams to reduce unnecessary exposure and overly permissive configurations.
• Research emerging application-layer and cloud threats, update internal security guidance, and promote secure coding and DevSecOps practices.

Required qualifications

• Bachelor’s degree in Information Technology, Computer Science, Cybersecurity, Engineering, a related discipline, or equivalent relevant experience.
• At least 3 years of experience in network engineering, cloud networking, network security, application security, or cloud security infrastructure support.
• Demonstrated knowledge of OWASP Top 10, web application architecture, HTTP, APIs, REST, and GraphQL.
• Hands-on experience with SAST/DAST tools, vulnerability triage, manual code review, and secure SDLC or CI/CD workflows.
• Working knowledge of at least one programming or scripting language such as Python, JavaScript, Java, or C#, along with strong analytical, troubleshooting, communication, and cross-functional collaboration skills.

Preferred qualifications

• Hands-on experience securing cloud environments in AWS, Microsoft Azure, or GCP.
• Experience with container and orchestration security, including Docker and Kubernetes.
• Experience using Infrastructure as Code tools such as Terraform, Bicep, or ARM templates to deploy and validate security controls.
• Experience configuring enterprise or cloud-native firewalls, integrating third-party network security appliances, and troubleshooting complex cloud connectivity, application, firewall, and API issues.
• Relevant certifications such as CSSLP, CompTIA Security+, or an ethical hacking certification.

Technologies

• SAST, DAST, OWASP Top 10
• HTTP, APIs, REST, GraphQL
• CI/CD, GitHub, GitLab, Jenkins
• Terraform, Bicep, ARM templates
• Python, JavaScript, Java, C#
• AWS, Microsoft Azure, GCP
• Docker, Kubernetes

Clearance

• Active Secret security clearance or higher.

Compensation

USD 115,000 - 135,000 per year.