Application Security Engineer: DevSecOps & AI-assisted Testing

2755 Barclays Services Corpor; United States; On-site; USD 125,000 - 170,000; Full time

Job summary

Barclays is seeking an Application Security Analyst to support the delivery and enhancement of Application Security and DevSecOps capabilities. You will evaluate findings, validate risk, support remediation, and convert testing data into practical insights for engineering and security teams.

You will help embed security controls across the software development lifecycle and ensure compliance with cyber governance requirements, policies, and standards.

Qualifications

• Running one or more of SAST, SCA or DAST scans; triaging and validating findings; investigating false positives; assessing severity and exploitability; and working with developers to track remediation.
• Testing APIs and understanding weaknesses in authentication, authorization, input validation, data exposure, and business logic.
• Applying secure coding knowledge in Java/Spring, .NET, Go, Python or JavaScript/TypeScript, and supporting security testing within CI/CD and cloud-native workflows.
• Evaluating security data using spreadsheets, query or reporting tools to identify trends, prioritize risk, monitor remediation, and produce accurate operational metrics and dashboards

Responsibilities

• Evaluate security findings, validate risk, support remediation, and convert testing data into practical insights for engineering and security stakeholders.
• Embed security controls across the software development lifecycle and support compliance with cyber governance requirements, policies, and standards.
• Communicate complex security findings to stakeholders and drive remediation actions.

Skills

SAST/SCA/DAST

API security

CI/CD security

Secure coding

Tools

Spreadsheets

Query/Reporting tools

Job description

Barclays is seeking an Application Security Analyst to support the delivery and enhancement of Application Security and DevSecOps capabilities. You will evaluate findings, validate risk, support remediation, and convert testing data into practical insights for engineering and security teams.

You will help embed security controls across the software development lifecycle and ensure compliance with cyber governance requirements, policies, and standards.