IT Security Auditor

vTech Solution; Michigan; Hybrid; USD 90,000 - 130,000; Full time

Job summary

vTech Solution is seeking an experienced IT Security Auditor to strengthen secure coding, assess applications, and improve API and cloud security within a hybrid enterprise environment. You will collaborate with development teams to embed secure practices across web, mobile, and cloud applications.

The role requires hands-on experience with SAST/DAST/SCA tools, knowledge of OWASP Top 10, API security, JWT/OAuth/OIDC, and CI/CD security automation. A CJIS background check is required.

Qualifications

• 5+ years of total IT experience
• 3+ years in application security, secure development, or security auditing
• Hands-on experience with SAST, DAST, SCA, ASOC, container, and cloud security tools
• Strong knowledge of OWASP Top 10, API Security, JWT, OAuth, OIDC, and PKCE
• Experience with Angular, React, Node.js, Java, Spring Boot, or .NET
• Knowledge of HTTP request/response headers and secure application development
• Ability to pass a CJIS background check

Responsibilities

• Conduct application security assessments using SAST, DAST, SCA, ASOC, and related tools
• Partner with software development teams on secure coding practices
• Review HTTP request/response headers, web traffic, and API security risks
• Identify and help remediate OWASP Top 10 vulnerabilities
• Support DevSecOps, security automation, and continuous compliance efforts
• Strengthen secure development practices across web, mobile, and cloud applications

Skills

Security auditing

Application security

Secure development

Secure coding practices

OWASP Top 10

API security

JWT/OAuth/OIDC/PKCE

Web/mobile cloud security

DevSecOps

Tools

Coverity

BlackDuck

Fortify

SAST tools

DAST tools

Job description

Job Summary:
We are hiring an experienced IT Security Auditor with a strong application security and software development background. This role will work with development teams to strengthen secure coding practices, identify vulnerabilities, improve API and cloud security, and support secure application delivery in a hybrid enterprise environment.

Key Responsibilities:

• Conduct application security assessments using SAST, DAST, SCA, ASOC, and related tools
• Partner with software development teams on secure coding practices
• Review HTTP request/response headers, web traffic, and API security risks
• Identify and help remediate OWASP Top 10 vulnerabilities
• Support DevSecOps, security automation, and continuous compliance efforts
• Strengthen secure development practices across web, mobile, and cloud applications

Required Skills and Certification:

• 5+ years of total IT experience
• 3+ years in application security, secure development, or security auditing
• Hands-on experience with SAST, DAST, SCA, ASOC, container, and cloud security tools
• Strong knowledge of OWASP Top 10, API Security, JWT, OAuth, OIDC, and PKCE
• Experience with technologies such as Angular, React, Node.js, Java, Spring Boot, or .NET
• Knowledge of HTTP request/response headers and secure application development
• Ability to pass a CJIS background check

Preferred Skills and Certification:

• Experience with Coverity, BlackDuck, SRM, Fortify
• Cloud experience with Azure, AWS, or GCP
• Background in DevSecOps, security automation, and distributed applications
• Familiarity with SANS, CERT, CWE Top 25, Critical Security Controls, CSA, and SafeCode

Scheduling:

• 40 hours/week
• Hybrid schedule
• Wednesdays and Thursdays onsite are mandatory
• Must be available for a virtual first-round interview and in-person second-round interview