Application Security Analyst

Hexaware Technologies; Alpharetta (GA); On-site; USD 90,000 - 150,000; Full time

Job summary

Hexaware Technologies in Alpharetta, GA seeks an Application Security Analyst to protect software through hands-on security assessments across web apps, APIs, microservices, and backend systems. You will deliver actionable reports, validate remediation, and advocate secure coding throughout the SDLC.

You will perform manual assessments, run pen tests, review code, and work with dev teams to improve security postures. Strong communication and cloud/API security experience are valued.

Qualifications

• Hands-on manual app security assessments across web apps, APIs, microservices.
• Ability to identify vulnerabilities and validate remediation.
• Experience communicating findings to technical and non-technical stakeholders.

Responsibilities

• Perform manual app security assessments across web apps, APIs, microservices, and backend systems.
• Run application penetration testing to identify vulnerabilities and exploitation opportunities.
• Conduct secure code reviews to uncover insecure practices.
• Assess architectures and recommend security improvements throughout the SDLC.
• Identify and prioritize vulnerabilities by exploitability and impact.
• Analyze findings to determine root causes and support remediation.
• Partner with development teams to deliver guidance and best practices.
• Evaluate risks in cloud-native and API-driven environments.
• Use Burp Suite, OWASP ZAP, proxies, scanners, fuzzers, and API testing platforms.
• Validate fixes through retesting and verification; build repeatable testing methodologies.
• Create security assessment reports with scope, findings, severity, and remediation recommendations.
• Present findings to technical and non-technical stakeholders and set remediation priorities.

Skills

Manual security assessments

Penetration testing

Secure code reviews

OWASP Top 10 knowledge

OWASP ASVS knowledge

Java

C#

Python

JavaScript/TypeScript

Go

Node.js

Cloud-native / API-driven security

Secure SDLC practices

Threat modeling

Excellent communication

Tools

Burp Suite

OWASP ZAP

Security Proxies

Web Application Scanners

Fuzzing tools

API testing platforms

Job description

Hexaware Technologies is seeking an Application Security Analyst in Alpharetta, Georgia, United States (onsite). In this role, you will help protect modern software by finding application security risks early, validating remediation, and communicating priorities clearly to both technical and non-technical stakeholders. The position focuses on hands-on security assessments across web applications, APIs, microservices, and backend systems, with an emphasis on actionable reporting and repeatable testing methods.

What you’ll do

• Perform manual application security assessments across web applications, APIs, microservices, and backend systems.
• Run application penetration testing to identify vulnerabilities, attack vectors, and exploitation opportunities.
• Conduct secure code reviews to uncover insecure coding practices and validate adherence to security standards.
• Assess application architectures and recommend security improvements throughout the Software Development Lifecycle (SDLC).
• Identify, validate, and prioritize vulnerabilities based on exploitability, business impact, and potential risk.
• Analyze security findings to determine root causes and support effective remediation.
• Partner with development teams to deliver remediation guidance and security best practices.
• Evaluate risks in modern application architectures, including cloud-native and API-driven environments.
• Use industry-standard testing tools, including Burp Suite, OWASP ZAP, security proxies, web application scanners, fuzzing tools, and API testing platforms.
• Validate fixes through re-testing and verification activities.
• Build repeatable testing methodologies and security assessment procedures.
• Create security assessment reports covering scope and methodology, technical findings with evidence, severity ratings, root cause analysis, business impact, and practical remediation recommendations.
• Present findings to technical and non-technical stakeholders, and communicate remediation priorities to developers, architects, project teams, and leadership.

What you bring

• Strong experience performing manual application security assessments and penetration testing.
• Deep understanding of common application vulnerabilities and attack techniques.
• Hands-on ability to identify and exploit application security weaknesses in web applications, APIs, and backend services.
• Strong understanding of secure design and secure development practices.
• Proven experience conducting manual source code reviews and identifying insecure coding practices.
• Experience reviewing code in one or more languages: Java, C#, Python, JavaScript/TypeScript, Go, Node.js.
• Strong knowledge of OWASP Top 10, OWASP ASVS, secure coding best practices, application security testing methodologies, and industry security controls and frameworks.
• Understanding of authentication, authorization, session management, encryption, and API security principles.
• Experience assessing vulnerability severity using industry-standard methodologies.
• Strong analytical and problem-solving skills.
• Excellent written and verbal communication skills.
• Ability to communicate effectively with developers, architects, project teams, and executive stakeholders.

Tools and technologies

• Burp Suite, OWASP ZAP, Security Proxies, Web Application Scanners, Fuzzing Tools, API Testing Platforms
• Java, C#, Python, JavaScript/TypeScript, Go, Node.js
• OWASP Top 10, OWASP ASVS

Preferred qualifications

• Previous software development experience.
• Familiarity with microservices, REST APIs, cloud-native applications, containerized environments, and DevSecOps practices.
• Experience working in Agile development environments.
• Exposure to CI/CD security testing and automation.
• Industry certifications such as GWAPT, GPEN, OSCP, CSSLP, CISSP, CEH.