Senior Application Security Analyst

Hybrid in Lafayette, Louisiana with a full-time role focused on improving application security across web apps, APIs, and backend services. You will work alongside engineering teams to validate vulnerabilities, strengthen secure coding practices, and deliver clear security assessment reporting, while benefiting from health and welfare coverage options and a 401(k) plan.

What you’ll do

• Conduct manual application penetration testing across web applications, APIs, and backend services.
• Perform detailed secure code reviews to uncover vulnerabilities and insecure coding practices.
• Identify, validate, and assess vulnerabilities using Burp Suite, OWASP ZAP, web proxies, fuzzers, scanners, and manual testing techniques.
• Evaluate findings based on exploitability, technical impact, and business risk.
• Recommend practical, prioritized remediation strategies for engineering teams.
• Apply OWASP security principles, secure coding practices, and industry standard application security controls.
• Produce comprehensive security assessment reports that include testing scope, methodology, findings, evidence, root cause, impact, and remediation guidance.
• Communicate technical findings clearly to both technical and non-technical stakeholders.
• Collaborate with development, security, and product teams to improve application security outcomes.

What you bring

• 6+ years of application security, penetration testing, or related cybersecurity experience.
• Strong hands-on experience with manual application penetration testing for web applications and APIs.
• Strong experience performing manual secure code reviews and identifying insecure coding practices.
• Advanced knowledge of OWASP Top 10, common application vulnerabilities, exploitation techniques, and remediation practices.
• Hands-on experience with Burp Suite, OWASP ZAP, web proxies, fuzzing tools, and vulnerability scanners.
• Ability to evaluate vulnerability severity based on exploitability, impact, and business risk.
• Familiarity with API security, authentication, authorization, session management, input validation, and other common application security controls.
• Experience reviewing source code in at least one modern programming language: Java, Python, JavaScript/TypeScript, or C#.
• Strong technical writing skills for documenting evidence, root causes, and remediation recommendations.
• Strong verbal communication skills to explain security risks to developers and non-technical stakeholders.
• Experience working with modern application architectures and software development teams.
• AWS hosted applications and cloud security concepts is preferred.
• Previous hands-on software development experience is a plus.
• Educational requirement: Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, or a related technical field.
• Relevant certifications such as OSWE, GWAPT, GPEN, or CSSLP are beneficial but not required unless specified by the client.

Tools and technologies

• Burp Suite, OWASP ZAP, OWASP Top 10
• Web proxies, fuzzing tools, vulnerability scanners
• Java, Python, JavaScript/TypeScript, C#
• AWS

Benefits

• Health and welfare benefits coverage options including medical, dental, vision, spending accounts, life insurance, voluntary plans
• 401(k) plan participation

Location: Lafayette, Louisiana (Hybrid onsite and remote)
Employment type: Full-time