Application Security Consultant - DAST

Application Security Consultant - DAST

Enterprise Cyber Security

Full Time, Springfield - MA

We are seeking a highly skilled and experienced Application Security Consultant to advance our application security initiatives, with a particular emphasis on dynamic application security testing (DAST). You will own and mature how we test running applications and APIs for exploitable weaknesses, drive secure development practices, and implement solutions that protect our systems and data from evolving threats. The role partners with development teams, security architects, leadership, and other stakeholders to embed security into every stage of the software development lifecycle.

Our Application Security team keeps Mass Mutual's software applications secure through rigorous assessment and proactive development team engagements. We work closely with security architects, Dev Ops engineers, and software developers, while our core focus is identifying and verifying vulnerabilities — including hands‑on dynamic testing of running applications and APIs — implementing security best practices, and helping development teams remediate. Our backgrounds span software engineering to red teaming, and we value continuous learning, innovation, and collaboration.

Your key responsibilities will ensure applications are resilient against emerging threats, reducing the financial and reputational damage of security incidents.

• Own and advance our dynamic application security testing (DAST) program — selecting, deploying, configuring, and maintaining DAST tooling across our web application and API estate.
• Design and run authenticated dynamic scans against complex applications, including session handling, multi-step workflows, single-page applications, and REST/GraphQL APIs.
• Integrate DAST into CI/CD pipelines and pre-production environments so dynamic testing runs continuously rather than as a point-in-time exercise, and define the thresholds that gate a release.
• Triage, validate, and tune DAST output — eliminating false positives, confirming exploitability through manual verification, and translating findings into actionable remediation guidance for development teams.
• Complement automated dynamic testing with manual techniques to identify, risk-assess, and prioritize application-level vulnerabilities (e.g., OWASP Top 10) that scanners alone do not surface.
• Conduct in-depth security assessments, including vulnerability scanning and code review.
• Conduct detailed threat modeling to identify attack vectors and potential weaknesses, and use the results to focus dynamic test coverage where risk is highest.
• Collaborate with security architects to design secure application architectures aligned to industry best practices, ensuring secure coding practices are followed and security controls are built into software designs.
• Partner with our SDLC Council to develop and maintain secure coding standards that empower developers to integrate security into their own workflow.
• Partner with Dev Ops teams to implement security controls within CI/CD pipelines for automated, seamless deployment of secure code.
• Maintain the broader application security testing toolchain, including static analysis (SAST) and software composition analysis (SCA), alongside DAST.
• Evaluate third-party software and APIs for security compliance, including dynamic testing of externally sourced components where appropriate.
• Support incident response for application security events, providing rapid identification and mitigation guidance.
• Ensure compliance with applicable security regulations, frameworks, and industry standards.
• Use reporting tools to communicate vulnerability and code-defect risk to Mass Mutual's cyber assets through metrics (KPIs,…