Application Security Analyst

PlanetArt; Woodridge (IL); Hybrid; USD 90,000 - 130,000; Full time

Benefits offered by this job

Health, Dental and Vision Insurance

401(k) with matching

Paid Time Off

Job summary

PlanetArt is seeking an Application Security Analyst to secure our apps, manage vulnerabilities, and oversee the Bug Bounty program in a hybrid work setting. You’ll collaborate with AppDev, MSSP teams, and researchers to strengthen secure coding and threat intelligence across cloud and on‑prem environments.

The role emphasizes hands-on SAST/DAST with Snyk and Semgrep, strong OWASP knowledge, and experience with AI-assisted security tools.

Qualifications

• Bachelor’s degree in CS/Cybersecurity or equivalent experience.
• 3–5 years in application security or vulnerability management.
• Hands-on with SAST/DAST tools (Snyk required; Semgrep preferred).
• Knowledge of OWASP Top 10, CWE and secure coding practices.
• Experience with AI-assisted security tools and prompt verification.
• Familiarity with cloud security, GRC frameworks, and incident response.

Responsibilities

• Manage vulnerabilities from SAST, DAST and other tools.
• Prioritize, assign, and track remediation with AppDev teams.
• Oversee Bug Bounty program triage and coordination.
• Conduct threat intelligence research for risks to apps.
• Validate MSSP security notifications and triage issues.
• Collaborate to improve secure coding practices and remediation guidance.
• Use AI tools for vulnerability triage and code review, with manual validation.
• Review AI-generated code for security weaknesses in development workflows.
• Assess AI-enabled apps for risks like prompt injection and data exposure.
• Support cloud security initiatives and third‑party risk reviews.

Skills

Application security

Vulnerability management

Threat intelligence

AI security

Cloud security

Written/verbal communication

Education

Bachelor’s degree

Tools

Snyk

Semgrep

OWASP Top 10

Bug bounty platforms

Job description

Company and Vision

PlanetArt’s vision is to be the leading seller of personalized and make-on-demand products worldwide. We provide consumers with unmatched tools and content and an unparalleled end-to-end customer experience that results in high-quality, meaningful finished products and memorable celebrations of life events.

The company’s brands include the popular FreePrints and FreePrints Photobooks apps and the industry leading SimplytoImpress card and stationery site, as well as Personal Creations, CafePress and ISeeMe! Visit www.planetart.com to learn more about our brands.

We have more than 500 team members across multiple offices, primarily in Calabasas CA, San Diego CA, Woodridge IL, Minneapolis, MN and Pleasanton, CA. We also have team members in two company-owned offices in China, as well as in Europe.

Job Overview

PlanetArt is looking for an Application Security Analyst to support the company’s Security Department. The successful candidate will be responsible for securing our applications by managing vulnerabilities identified through Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and other application security software (currently Snyk, with possible future use of Semgrep). This role will also oversee the Bug Bounty program, provide support for security notifications from the MSSP, conduct threat intelligence research, and contribute to governance, risk, compliance (GRC), cloud security, and third-party risk management activities. The analyst will use approved artificial intelligence (AI) tools to support security analysis and remediation, apply sound judgment to AI-generated outputs, and help assess the security of AI-enabled applications and development workflows.

PLEASE NOTE: Candidates must be local to or willing to relocate to the (office) area as we operate on a hybrid work model (3 days onsite, 2 remote)

What You’ll Do

Key Responsibilities

• Manage vulnerabilities identified through SAST, DAST, and other application security tools.
• Validate, prioritize, and assign vulnerabilities to Application Development (AppDev) teams; track remediation efforts and verify closure.
• Oversee the Bug Bounty program, including triage, validation, and coordination with AppDev and external researchers.
• Conduct threat intelligence research to identify risks to applications and the broader organization.
• Support MSSP-provided security notifications through validation, triage, and assignment of issues.
• Collaborate with AppDev to improve secure coding practices and provide remediation guidance.
• Use approved AI tools to assist with vulnerability triage, code review, threat research, and remediation guidance; independently validate findings and recommendations before acting on them.
• Review AI-generated code and AI-assisted development workflows for security weaknesses, and help AppDev teams apply secure coding and testing practices.
• Assess AI-enabled applications and integrations for risks such as prompt injection, sensitive data exposure, insecure output handling, and excessive permissions in AI agents and connected tools.
• Follow company policies for AI use, protect source code, credentials and confidential data, and contribute to guidance for evaluating AI tools and third‑party AI services.
• Contribute to organizational GRC initiatives, audits and compliance efforts.
• Provide support for cloud security initiatives and third-party risk management reviews.

What You Should Have

Skills, Qualifications, and Requirements

• Bachelor’s degree in Computer Science, Cybersecurity, or equivalent experience.
• 3–5 years of experience in application security, vulnerability management, or related role.
• Hands‑on experience with SAST/DAST tools (Snyk required; Semgrep preferred).
• Knowledge of OWASP Top 10, CWE, and secure development practices.
• Practical experience using generative AI tools or AI‑assisted security and development tools, including writing effective prompts, verifying outputs and recognizing inaccurate or unsupported results.
• Working knowledge of large language models (LLMs), common AI application security risks, and controls such as input and output validation, access restrictions and protection of sensitive data.
• Ability to evaluate AI‑generated code and security recommendations using manual review and established testing tools; understanding of responsible AI use and data handling requirements.
• Familiarity with bug bounty platforms and coordinated vulnerability disclosure processes.
• Understanding of threat intelligence processes and incident response workflows.
• Strong written and verbal communication skills with the ability to collaborate across technical and business teams.
• Preferred: Experience with cloud platforms (AWS, GCP, Azure), GRC frameworks (NIST CSF, ISO 27001, SOC 2) and professional certifications (GWAPT, OSWE, GWEB, CEH, CISSP). Familiarity with security testing of LLM applications, retrieval‑augmented generation (RAG), AI agents or AI service integrations is also preferred.

What You Can Expect

Working Conditions

• Work is performed in an office environment with low to moderate noise levels.
• Occasional lifting of up to 20 pounds.
• Position requires regular continuous use of computer.
• Position requires regular sitting and standing.
• Position requires regular interaction with team members through the following methods: in‑person, phone, WebEx, Slack or email.
• May require occasional travel.
• This is a hybrid position; employees are expected to be in the office three days per week (Monday, Tuesday and Thursday) with the option of working remotely two days (Wednesday and Friday).

PlanetArt offers a comprehensive benefits package, including:

• Health, Dental and Vision Insurance
• Life Insurance
• 401(k) with matching
• Excellent Work/Life Balance – Paid Time Off, Sick Days, Paid Holidays and Floating Holidays
• Employee Product Discounts