Analyst Lead, Cybersecurity

Fidelity Information Services, LLC; Brown Deer (WI); On-site; USD 120,000 - 190,000; Full time

Job summary

Fidelity Information Services, LLC in the United States seeks a Senior Application Security Engineer to lead hands-on security efforts across web, API, mobile, and cloud-native apps.

You will perform deep assessments (SAST/DAST/SCA), perform threat modelling, IaC and container security, and drive secure development practices while guiding engineering teams to fix vulnerabilities at scale.

Qualifications

• Strong knowledge of application security practices.
• Experience conducting SAST/DAST/SCA assessments.
• Ability to review source code and perform threat modelling.

Responsibilities

• Own and continuously improve the application attack surface management program.
• Perform and oversee SAST and DAST in CI/CD pipelines.
• Conduct in-depth manual source code reviews across languages.
• Lead API security assessments for REST, GraphQL, gRPC and SOAP services.

Skills

Attack Surface Management

SAST

DAST

SCA

Threat Modelling

IaC Security

Container Security

Penetration Testing

Java

C#/.NET

Python

JavaScript/TypeScript

CI/CD Tooling

Tools

CI/CD Tooling

Job description

Position Type

Full time

Type Of Hire

Experienced (relevant combo of work and education)

Job Description

About FIS

At FIS, progress starts with people. We believe diverse perspectives lead to stronger ideas, better solutions and greater impact. If you're looking for a place where you can contribute, grow and help advance the future of financial technology, your next opportunity is here.

About the role

As a Senior Application Security Engineer in FIS Cybersecurity, you will be a hands-on technical leader in our Attack Surface Management function.

You will identify, assess and reduce security risk across web, API, mobile, cloud-native and AI-enabled applications that support global financial services. You will perform deep technical assessments, including SAST, DAST, SCA, manual source code review, threat modelling, Infrastructure as Code (IaC) and container security, and Android and iOS penetration testing.

You will also shape the security policies, encryption standards and secure development practices that engineering teams across FIS follow. You will serve as a subject matter expert who can find complex vulnerabilities, explain their business impact and help development teams fix them at scale.

What you will be doing

• Own and continuously improve the application attack surface management program. This includes discovering, inventorying and risk-ranking internet-facing applications, APIs, mobile apps and cloud assets, and finding shadow IT and unmanaged exposure.
• Perform and oversee static application security testing (SAST) and dynamic application security testing (DAST). You will tune rulesets, triage findings, reduce false positives and integrate scanning into CI/CD pipelines.
• Conduct in-depth manual source code reviews across languages such as Java, C#/.NET, Python, JavaScript/TypeScript, Cobol, Go and Kotlin/Swift. You will look for business logic flaws, injection, authentication and authorization weaknesses, insecure deserialization, cryptographic misuse and race conditions.
• Lead API security assessments for REST, GraphQL, gRPC and SOAP services. These cover authentication and authorization (OAuth 2.0