Security Scanning

Security Scanning Cybersecurity Jobs

3 jobs found

Today

Application Security Analyst

Consumers Credit Union, Illinois Lake Forest, IL

Lake Forest, IL

Today

$68k - $109k/yr Full time Api Security Application Security Data Security

Apply Now

Job Description

Consumers Credit Union, Illinois is seeking an Application Security Analyst to help protect application systems and strengthen the organization’s application security program. In this hybrid role based in Lake Forest, IL, you will partner with engineering teams across the Software Development Lifecycle (SDLC) to test, remediate, and improve application-layer security.

Key Responsibilities

Conduct static and dynamic application security testing (SAST/DAST) using tools such as Veracode, Checkmarx, or Burp Suite.
Find, analyze, and prioritize vulnerabilities, then collaborate with developers to support timely and effective remediation.
Configure and optimize Web Application Firewall (WAF) rules and monitor logs to detect and mitigate threats.
Participate in secure design reviews, threat modeling, and architecture assessments.
Support API security, including authentication methods like OAuth and API keys, along with secure data handling practices.
Track remediation across teams, validate fixes, and document vulnerability closure.
Maintain clear, current documentation on AppSec processes, tools, and standards.
Stay current on OWASP Top 10, SANS CWE Top 25, and emerging application-layer threats.

Requirements

Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or a related field (preferred).
2+ years of experience in application security or software development with security responsibilities, or 4+ years in lieu of education.
Certifications in CSSLP, CASE, or GWEB (preferred).
2 years of experience performing SAST and DAST.
Strong understanding of secure coding practices and how to integrate security into the SDLC.
Hands-on experience with application security tools and vulnerability management, including Veracode, Checkmarx, or Burp Suite.
Ability to convert technical findings into actionable guidance for developers.
Curiosity and commitment to staying ahead of evolving cyber threats.
Strong communication and collaboration skills.

Technologies

Veracode, Checkmarx, Burp Suite
SAST, DAST
Web Application Firewall (WAF)
OAuth, API keys
OWASP Top 10, SANS CWE Top 25
Software Development Lifecycle (SDLC)

Location and Schedule

Hybrid schedule with 3 days/week at the corporate office in Lake Forest, IL.
Flexibility to be assigned an on-call schedule approximately once every 6 weeks.
Local Northern IL/Southeast WI candidates only.

Compensation

Annual salary range: $67,980 to $108,768.
Eligible for an annual bonus opportunity.
Salary offers consider skill sets, experience and training, licensure and certifications, and other business and organizational needs.
It is not typical for an individual to be hired at or near the top of the salary range; compensation depends on the facts and circumstances of each case.

Benefits

Medical (High Deductible, HMO and PPO)
Dental
Vision
Spending accounts
Short-term disability
Long-term disability
Life insurance
401(k) savings plan eligible at any time
Automatically enrolled in the pension plan following six months of employment and 1,000 hours of service and reaching age 20
Annual bonus opportunity (eligible)

View full job page →

1d ago

Security Engineer, Application Security

Mercor New York, NY

New York, NY

1d ago

$130k - $400k/yr Full time Application Security DevSecOps Engineer

Apply Now

Job Description

Mercor is building a platform where the application layer is treated as the most important security surface. In this role, you will own application security end-to-end for a fast-moving product used by 300K+ experts and enterprise clients that handle sensitive AI training data.

You will embed security into the SDLC, improve how vulnerabilities are found and remediated, and help operationalize secure development across engineering. The position is based in New York, NY (onsite), with a salary range of USD 130,000 - 400,000 per yearly and a minimum of 5 years of relevant experience.

Responsibilities

Run security review workflows integrated into the SDLC, including PR-level analysis to catch authentication bugs, injection flaws, and business logic errors before release.
Own SAST/DAST pipelines integrated into CI/CD so security shifts earlier in the process without slowing deployments.
Operate vulnerability management using prioritization based on real exploitability, not CVSS score alone.
Define secure coding standards and guardrails that make the safe path easier for 50+ engineers to follow.
Create threat models for new features and architectural changes, with particular focus on AI data pipelines, payment flows, and multi-tenant boundaries.
Support bug bounty program operations by triaging HackerOne reports, validating findings, and driving fixes through to closure.

Requirements

Have identified and fixed real vulnerabilities in production applications, not only scan results.
Demonstrate strong web application security depth, with OWASP Top 10 as a baseline and the ability to reason about attack chains and business logic flaws.
Strong ability in at least one language: Python, TypeScript, or Go, including reviewing PRs and spotting issues such as an auth bypass.
Experience building or tuning SAST/DAST tooling, including familiarity with tools such as Semgrep, CodeQL, Snyk, and Burp (or similar).
Comfort threat modeling modern web frameworks, APIs, and authentication patterns.
Experience managing a vulnerability pipeline from discovery and prioritization through verified remediation.
5+ years of professional experience in application security, security engineering, or software engineering with a strong security focus.

Technologies

Python, TypeScript, Go
Semgrep, CodeQL, Snyk, Burp
HackerOne
OWASP Top 10

Benefits

Bi-annual performance bonus structure
Generous equity grant vested over 4 years
Up to $15k relocation bonus
$10K housing bonus (if you live within 0.5 miles of the office)
$1.5K monthly stipend for meals
Free Equinox membership
$200 monthly laundry reimbursement
$200 monthly personal wellness reimbursement
Health, Dental, Vision insurance

Bonus Points

Experience running or triaging a bug bounty program such as HackerOne or Bugcrowd.
Offensive security skills including penetration testing and attacker-minded analysis.
Experience securing AI/ML applications, including model serving APIs, training data pipelines, and prompt injection defense.
Familiarity with supply chain security such as dependency scanning and registry firewalls (Socket, Snyk).
Built custom security tooling that other teams still use.
Contributions to open source security projects or published vulnerability research.

Why Mercor

Real problem: application security at scale is hard, and the role focuses on defenses that matter across a fast-moving platform.
AI-native AppSec: use frontier AI tools daily for code review, vulnerability analysis, and work that benefits from an AI co-pilot.
Ownership from day one: you own application security across code review processes, CI/CD security, and bug bounty operations.
See the future early: work alongside AI labs to understand frontier model capabilities months before broader market adoption.

View full job page →

2d ago

Penetration Tester

General Dynamics Information Technology Remote 🇺🇸 Remote

Remote

2d ago

$123k - $167k/yr Full time Api Security Application Security Cloud Platforms

Apply Now

Job Description

Support the Case Management Modernization (CMM) Program with hands-on penetration testing and security assessment activities ahead of Application ATO.

Responsibilities

Perform application, API, and cloud penetration tests on CMM systems prior to ATO submission.
Conduct web, mobile, API, and microservices security testing using industry-standard tools and manual exploitation techniques.
Execute AWS cloud penetration testing within approved boundaries including IAM, S3, Lambda, API Gateway, ECS/EKS, and networking.
Run static and dynamic analysis, including security-focused code review.
Conduct credentialed and uncredentialed scans, privilege escalation testing, and lateral movement analysis.
Validate implementation of NIST 800-53 controls across AC, AU, IA, SC, SI, and CM families.
Support RMF Step 3 (Security Assessment) activities and provide evidence for ATO packages.
Identify vulnerabilities across application layers, cloud infrastructure, and CI/CD pipelines.
Partner with developers, cloud engineers, and DevSecOps teams to validate fixes and retest vulnerabilities.
Provide detailed remediation guidance aligned with secure coding and cloud security best practices.
Track findings in Jira or equivalent tools and ensure closure prior to ATO milestones.
Prepare Security Assessment Reports (SAR), penetration test summaries, and risk findings for AO stakeholders.
Document exploitation steps, proof-of-concepts, and risk severity aligned with federal scoring methodologies.
Contribute to System Security Plans (SSP), POA&Ms, and ATO evidence packages.
Support pre-ATO readiness reviews, including control validation and security walkthroughs.
Participate in tabletop exercises, threat modeling sessions, and architecture reviews.
Validate system resilience through stress, failover, and adversarial resilience testing.
Ensure compliance with federal security standards including NIST, FISMA, and AO-specific guidelines.
Integrate security testing into Agile sprints and provide security input during sprint planning, backlog refinement, and release readiness reviews.
Support secure CI/CD pipeline enhancements, including automated security scanning.

Requirements

8+ years of experience in penetration testing, application security, or ethical hacking security roles.
Experience documenting test plans, test procedures, and detailed security findings.
Experience supporting federal security assessments or enterprise-scale security testing.
Hands-on penetration testing experience for web applications, APIs, microservices, and cloud environments.
Strong proficiency with tools such as Burp Suite, OWASP ZAP, Metasploit, Nmap, Nessus, Nikto, K6 Security, or custom scripts.
Experience testing applications built with NodeJS, ReactJS, REST APIs, and microservices.
Strong AWS security understanding including IAM, VPC, S3, Lambda, API Gateway, ECS/EKS, CloudTrail, and CloudWatch.
Experience with NIST 800-53, RMF, FedRAMP, or federal ATO processes.
Ability to interpret logs, metrics, and security telemetry to identify attack paths.
Familiarity with SIEM and monitoring tools such as Datadog, ELK, CloudWatch, and Grafana.
Experience with container security (Docker, Kubernetes, OpenShift).
Understanding of network security, distributed tracing, and adversarial testing techniques.
Strong analytical, communication, and documentation skills.
8+ years general experience with BS/BA degree, or 6+ years with MA/MS degree (may be considered in lieu of degree).
6+ years experience in integration, regression, and system testing using automated testing tools in web-based applications.
Experience writing test cases, test plans, executing test scripts, reporting defects, and preparing test result reports.
Experience across the QA Life Cycle, including designing, developing, executing, and documenting QA processes (test plans, test cases, test procedures, and test scripts).
OSCP, OSWE, GWAPT, GPEN, or similar offensive security certifications.
AWS Security Specialty.
SAFe, DevSecOps, or Agile certifications are beneficial.
AWS Certified Security - Specialty (AWS Security Specialty | Amazon Web Services).

Technologies

React, NodeJS, microservices, REST APIs
AWS: IAM, VPC, S3, Lambda, API Gateway, ECS/EKS, CloudTrail, CloudWatch
Container and orchestration: Docker, Kubernetes, OpenShift
Testing and security tools: Burp Suite, OWASP ZAP, Metasploit, Nmap, Nessus, Nikto, K6 Security, custom Python/JavaScript tools
Observability/monitoring: Datadog, ELK Stack, Prometheus, Grafana
CI/CD and tooling: Jenkins, GitLab CI/CD, GitHub Actions, SonarQube, Checkmarx, Fortify
Collaboration/work tracking: Jira, Confluence, SharePoint, MS Teams
Analytics: Power BI

Location and Work Details

Location: Remote (working from the USA)
Travel required: None

Salary

Range: $123,250 - $166,750 per year

Additional Information

Category: Cyber and IT Risk Management
Req#: RQ223925
Requisition type: Regular
Public trust: Other
Clearance level: None
Key skills for success: Automated Testing, AWS Cloud Computing, Infrastructure Penetration Testing, Security Controls, Security Testing

Work Requirements (Interview/Verification)

Virtual interviews require being on camera.
Identity verification may include taking your picture to prevent fraud.
Authorization to collect, process, and use biometric data for identity verification and security purposes.

View full job page →

Security Scanning Cybersecurity Jobs

Application Security Analyst

Security Engineer, Application Security

Penetration Tester

Get Security Scanning Cybersecurity Jobs alerts