DevSecOps AppSec Analyst: CI/CD & Cloud Security

EMCOR Group; Phoenix, Northern (AZ, KY); Hybrid; USD 98,000 - 116,000; Full time

Benefits offered by this job

Medical, Dental, Vision benefits

401(k) savings plan

Employee assistance program

Job summary

EMCOR Group is seeking an Application Security Analyst to advance our DevSecOps program by integrating AppSec tools into CI/CD, managing vulnerabilities, and guiding development teams on secure practices. You will mature our security posture, reduce the attack surface, and collaborate with cross-functional partners across cloud platforms.

The role involves reviewing Terraform configurations, tuning WAF policies, and responding to security findings.

Qualifications

• 3+ years in Application Security or DevSecOps.
• Experience with cloud platforms (Azure, AWS, GCP, OCI).
• Experience with CI/CD and developer workflow automation.
• Terraform experience for Azure infrastructure.
• WAF policy management for Azure Front Door.
• GHAS or Defender for Cloud experience.
• Proficient in PowerShell.
• Strong communication and PM skills.

Responsibilities

• Support and monitor the enterprise information security system as directed by management.
• Manage operations for Application Security products and incidents.
• Document findings and help improve security protocols.
• Maintain and upgrade application security platforms.
• Tune application security policies and rulesets.
• Integrate security tools into CI/CD pipelines and workloads.
• Contribute to IaC security reviews of Terraform configurations.
• Validate Terraform changes for security and compliance.
• Monitor code platforms for security threats and incidents.
• Write SIEM queries and analyze results.
• Remediate tool findings with business and IT partners.
• Manage and tune WAF policies, including Azure Front Door.
• Contribute to security initiatives and special projects.

Skills

DevSecOps

PowerShell

Cloud security

Incident response

Communication

Project management

Tools

Terraform (Azure)

GitHub Actions

Azure Front Door WAF

GHAS

Microsoft Defender for Cloud

Job description

EMCOR Group is seeking an Application Security Analyst to advance our DevSecOps program by integrating AppSec tools into CI/CD, managing vulnerabilities, and guiding development teams on secure practices. You will mature our security posture, reduce the attack surface, and collaborate with cross-functional partners across cloud platforms.

The role involves reviewing Terraform configurations, tuning WAF policies, and responding to security findings.