DevSecOps Application Security Analyst

EMCOR Group, Inc.; Phoenix (AZ); On-site; USD 98,000 - 116,000; Full time

Job summary

EMCOR Group, Inc. seeks an Application Security Analyst who would support EMCOR’s Security Program with a primary focus of integrating AppSec tools into CI/CD pipelines, managing application security vulnerabilities and partnering with development teams to prioritize security in their practices.

This role plays a key part in maturing our DevSecOps culture, reducing EMCOR’s overall attack surface and strengthening the EMCOR Information Security Program.

Qualifications

• 3+ years of hands-on experience in Application Security, DevSecOps or related role.
• Experience with cloud platforms (Azure, AWS, GCP, OCI).
• Experience with CI/CD and developer workflow automation (GitHub Actions, Azure DevOps).
• Experience developing or reviewing Terraform to deploy Azure infrastructure, including reusable modules.
• Experience managing and tuning WAF policies, specifically for Azure Front Door.
• Experience triaging and remediating vulnerabilities identified by GHAS or Defender for Cloud (CodeQL, Secret Scanning, Dependency Review).
• Proficiency with PowerShell for administration and automation.
• Strong communication and professional interaction at all levels.
• Good project management skills and commitment to customer service.

Responsibilities

• Support and monitor enterprise information security systems as directed by management.
• Manage daily operations and support for Application Security products, including incident and ticket resolution.
• Provide expertise during incidents, document findings and help improve protocols.
• Maintain and upgrade application security platforms.
• Tune application security policies and rulesets.
• Collaborate with business and IT partners to integrate security tools into CI/CD pipelines and workloads.
• Contribute to security reviews of Terraform configurations and IaC modules.
• Validate Terraform changes for security and cloud architecture alignment.
• Monitor code platforms for security threats and respond to findings.
• Write SIEM queries and analyze results.
• Respond to security tool findings and coordinate remediation.
• Implement and manage Web Application Firewalls (WAFs) and tune rulesets.
• Contribute to security projects and initiatives.
• Perform special projects as needed.

Skills

Application Security

Cloud Platforms

CI/CD

Terraform

WAF Management

GHAS/Defender for Cloud

PowerShell

Communication

Project Management

Tools

GitHub Actions

Azure DevOps Pipelines

Terraform

GHAS

Microsoft Defender for Cloud

Job description

EMCOR Group, Inc. seeks an Application Security Analyst who would support EMCOR’s Security Program with a primary focus of integrating AppSec tools into CI/CD pipelines, managing application security vulnerabilities and partnering with development teams to prioritize security in their practices.

This role plays a key part in maturing our DevSecOps culture, reducing EMCOR’s overall attack surface and strengthening the EMCOR Information Security Program.