Senior Application Security Analyst

Protect data and applications by embedding application security controls across the SDLC in Microsoft Azure and hybrid or multi-cloud environments. This Senior Application Security Analyst role supports secure software development and compliance for WAHBE, with an emphasis on threat modeling, vulnerability management, secure coding guidance, and continuous validation through CI/CD.

• Serve as a senior subject matter expert for application security across Microsoft Azure and cloud-native architectures, including hybrid and multi-cloud environments.
• Coordinate application security assessments, including code reviews aligned to WAHBE security policies,
  NIST
  , OWASP
  , and regulatory compliance (including CMS and IRS
  ), with a focus on API and microservices security.
• Support implementation and continuous improvement of the Secure Software Development Lifecycle (SSDLC) by integrating security controls and best practices into development and deployment processes.
• Partner with Delivery, architects, and Dev Ops engineers to embed security throughout the SDLC, including participation in threat modeling, security requirement reviews, and architecture discussions.
• Review application and solution architectures to identify security weaknesses, attack surfaces, and insecure design patterns, and provide remediation recommendations.
• Conduct security design reviews for web applications, APIs, microservices, containers, and serverless technologies to support secure implementation practices.
• Develop, document, and enforce secure coding standards, secure design guidelines, and application security procedures to promote consistent and secure development.
• Enhance and lead the Application Security and Penetration Testing program, including security and penetration testing and integrating automated security testing into CI/CD
  .
• Perform vulnerability triage, validation, and risk analysis using security tools, threat intelligence, and manual analysis, including false-positive review and remediation prioritization.
• Track remediation activities and work with development teams to support timely resolution or appropriate risk acceptance documentation; recommend compensating controls when needed.
• Support monitoring and reporting by preparing vulnerability metrics, remediation status updates, trend analysis, and risk reports for leadership and stakeholders.
• Develop and deliver secure coding awareness sessions and application security training materials for development and engineering teams.
• Review Requests for Change (RFCs), product enhancements, and system modifications from a security perspective to ensure impacts and requirements are addressed.
• Continuously monitor cloud and on-premises environments for security events and anomalies, investigate root causes and impacts, support containment and recovery, and contribute to incident reports including post-incident analysis and lessons learned.
• Collaborate with Compliance, Risk Management, Audit, Infrastructure Security, and Dev Ops teams to support audits, regulatory compliance, and secure cloud adoption initiatives; ensure alignment with WAHBE security policies (including CMS and IRS
  ).
• Ensure security requirements are included in user stories and case development within Agile methodology (including misuse, abuse, and confuse cases).
• Assess the security posture of new enterprise solutions for procurement by identifying security risks and providing secure cloud adoption guidance.
• Provide technical consultation and assessments for cloud environments and containers, and help integrate application security into CI/CD as part of SSDLC
  , enforcing security in deployment workflows.
• Assist in maintaining and updating security policies, procedures, and standards, support roadmap and…