DevSecOps Application Security Analyst

EMCOR; Norwalk (CT); On-site; USD 98,000 - 116,000; Full time

Benefits offered by this job

Bonus eligible

Comprehensive benefits

Job summary

EMCOR Group, Inc. in Norwalk, CT seeks an Application Security Analyst to integrate AppSec tools into CI/CD pipelines, manage vulnerabilities, and partner with development teams to prioritize security in their practices.

This role improves EMCOR’s security maturity and reduces the attack surface of cloud deployments. The ideal candidate will have hands-on DevSecOps experience across cloud platforms, Terraform IaC, and WAF policy management, with strong PowerShell scripting and cross-functional

Qualifications

• 3+ years of hands-on experience in an Application Security, Product Security, DevOps or DevSecOps role.
• Experience working in cloud platforms (Azure, AWS, GCP, OCI).
• Experience with CI/CD and developer workflow automation such as GitHub Actions, Azure DevOps Pipelines.
• Experience developing or reviewing Terraform used to deploy Azure infrastructure, including reusable modules.
• Experience managing and tuning Web Application Firewall (WAF) policies, specifically for Azure Front Door.
• Experience triaging and remediating vulnerabilities identified by GHAS or Defender for Cloud, including CodeQL, Secret Scanning and Dependency Review.
• Demonstrated proficiency in using PowerShell for administration and automation purposes.
• Proven ability to communicate effectively and interact professionally at all organization levels.
• Strong project management capabilities.
• Ability to consistently deliver an exceptional standard of customer service.

Responsibilities

• Support and monitor the enterprise information security system as directed by management.
• Manage daily operations and support for Application Security products, including incident and ticket resolution.
• Provide expertise during incidents, document findings and help improve protocols.
• Maintain and upgrade application security related platforms.
• Tune application security related policies and rulesets.
• Collaborate with business and IT partners to integrate security tools into CI/CD pipelines and workloads.
• Contribute to security reviews of Terraform configurations and reusable modules supporting IaC.
• Validate Terraform changes for security, compliance and alignment with cloud architecture standards.
• Monitor code platforms and resources for security threats, investigate and respond to security incidents and findings.
• Write SIEM queries and perform analysis of results.
• Respond to security tool findings and collaborate with business and IT partners for remediation.
• Implement, configure, manage and support Web Application Firewalls (WAFs), including tuning of rulesets and policies.
• Contribute to various application security projects and initiatives.
• Perform special projects as needed.

Skills

Application Security

DevSecOps

Cloud Platforms

CI/CD Automation

Terraform

WAF Management

PowerShell

Communication Skills

Tools

GitHub Actions

Azure DevOps Pipelines

Terraform

GHAS

Microsoft Defender for Cloud

Azure Front Door

Job description

EMCOR Group, Inc. in Norwalk, CT seeks an Application Security Analyst to integrate AppSec tools into CI/CD pipelines, manage vulnerabilities, and partner with development teams to prioritize security in their practices.

This role improves EMCOR’s security maturity and reduces the attack surface of cloud deployments. The ideal candidate will have hands-on DevSecOps experience across cloud platforms, Terraform IaC, and WAF policy management, with strong PowerShell scripting and cross-functional