Principal Application Security Analyst

The Principal Application Security Analyst will design and run WPS’s enterprise application security program with a focus on reducing application risk across the SDLC. This individual-contributor role sits within the Cyber Threat Management team and combines application security testing, triage, developer enablement, and risk-focused reporting.

This position builds and operates the enterprise Application Security program, using secure-development standards to improve application risk posture throughout the software development lifecycle. The analyst manages day-to-day application-security testing and triage, engages developers to support secure coding, and helps translate enterprise security requirements into practical testing criteria.

• Build and operate WPS’s enterprise Application Security program to reduce application risk by operationalizing secure-development standards, strengthening developer secure-coding practices, running application-security testing tools, and reporting outcomes to technical, managerial, and executive audiences.
• Partner with Cyber Trust & Architecture to translate enterprise security standards into developer guidance and actionable testing criteria.
• Work independently with developers to interpret application security findings and communicate risk across multiple levels of the organization.
• Manage day-to-day application-security testing, triage, and developer engagement independently, while collaborating with Cyber Trust & Architecture on standards interpretation and with the Manager, Cyber Threat Management on program priorities.
• Operationalize secure-development standards by strengthening secure-coding practices, executing application-security testing using approved tooling, and providing reporting to technical, managerial, and executive stakeholders.
• Coordinate remediation of application vulnerabilities with developers and system owners, prioritize using actual exploitability and business risk, and validate fixes through retesting.

• U.S. Citizenship required due to Department of Defense restrictions.
• Bachelor’s degree in Cybersecurity, Computer Science, Software Engineering, Information Technology, Information Systems, or a related field, or an equivalent combination of education and relevant work experience.
• 5 or more years of progressive experience in application security, software security, Dev Sec Ops , or a related technical security discipline.
• Hands-on experience with application-security testing technologies such as SAST and DAST
  , including the ability to tune tools, independently validate findings, and translate cybersecurity standards and technical requirements into developer guidance and secure-coding training.
• Proficient knowledge of common application vulnerabilities and attack techniques, potentially including Authentication / Authorization, Injection, Session management, API security, insecure dependencies, and related topics.
• Knowledge of modern software development methodologies, CI/CD pipelines, APIs, and cloud-based application environments to integrate security testing into the development lifecycle.
• Strong analytical skills to distinguish exploitable vulnerabilities from false positives and prioritize remediation based on actual risk.
• Strong communication, problem solving, and decision-making skills.
• Wired (ethernet cable) internet connection from your router to your computer, with high speed cable or fiber and minimum internet performance of 10 Mbps downstream and 1 Mbps upstream (verifiable at ).
• Please review Remote Worker FAQs:

• Knowledge of OWASP Top 10, OWASP API Security Top 10, CWE, CVSS, and MITRE ATT&CK.
• Professional certification such as CSSLP, GWAPT, GWEB,…