Application Security Analyst

Open iT, Inc.; Lucena; On-site; PHP 600,000 - 1,000,000; Full time

Job summary

Open iT, Inc. seeks an Application Security Analyst to ensure products across on‑premises, web, and cloud are built with security in mind. You will work with developers to embed security into the SDLC, run vulnerability assessments, and support compliance initiatives.

Key duties include evaluating security tools, guiding secure coding practices, and reporting security findings to internal teams and customers. The role emphasizes collaboration with DevOps, testers, and security staff.

Qualifications

• Good understanding of application and web security fundamentals.
• Familiarity with OWASP Top 10 vulnerabilities.
• Basic knowledge of vulnerability assessment and security testing tools.
• Understanding of SDLC and secure coding practices.
• Familiarity with DevSecOps concepts and CI/CD security.
• Ability to analyze findings and distinguish real risks from false positives.

Responsibilities

• Research, evaluate, and recommend security tools and practices for development teams.
• Conduct vulnerability assessments and security testing across desktop, web, and cloud apps.
• Support secure coding and SSDLC integration in the development lifecycle.
• Contribute to security compliance initiatives (ISO 27001, SOC 2, GDPR).
• Collaborate with security, development, testing, and DevOps to align efforts with policies.
• Embed security into CI/CD pipelines and deployment processes.
• Monitor threats and communicate updates to the team.
• Provide security awareness and guidance to developers.
• Respond to customer and internal security inquiries with product security input.

Skills

App & Web Security

OWASP Top 10

Vulnerability Assessment

Secure SDLC

DevSecOps

CI/CD Pipelines

Risk Analysis

Communication Skills

Team Collaboration

Continuous Learning

Tools

Burp Suite

OWASP ZAP

Nessus

Nmap

SAST/DAST tools

Job description

The Application Security Analyst is responsible for ensuring that the company application products - whether on-premises, web-based, or cloud - are designed, developed and maintained with security in mind. This role involves conducting security research, evaluating and recommending security tools, supporting compliance initiatives, and proactively identifying vulnerabilities across all products. The analyst works closely with the software development team to embed security into every stage of the development lifecycle.

Key Responsibilities:

• Research, evaluate, and recommend security tools and practices to strengthen software development teams' security posture.
• Conduct vulnerability assessments and security testing across different types of applications (desktop, web and cloud).
• Support the software development team in implementing secure coding practices and integrating security into the development lifecycle (SSDLC)
• Contribute to security compliance initiatives (e.g. ISO 27001, SOC 2, GDPR and other relevant standards).
• Collaborate with the security team to align application security efforts with overall company security policies and strategies.
• Work with developers, software testers, and DevOps to embed security into CI/CD pipeline and deployment processes.
• Monitor and report on emerging threats, technologies, and best practices relevant to application security.
• Provide security awareness and guidance to the development team.
• Provide product security-related responses to customer security inquiries and requests from internal teams.

Skills & Qualifications:

• Good understanding of application and web security fundamentals
• Familiarity with common vulnerabilities such as the OWASP Top 10
• Basic knowledge of vulnerability assessment and security testing tools
• Understanding of software development and the SDLC
• Familiarity with secure coding concepts and DevSecOps practices
• Basic understanding of CI/CD pipelines
• Ability to analyze security findings and distinguish meaningful risks from false positives
• Good research and problem-solving skills
• Strong written and verbal communication skills
• Ability to work effectively with developers, testers, DevOps, and other technical teams
• Willingness and ability to continuously learn about emerging vulnerabilities, attack techniques, and security technologies