Lead AppSec Analyst & DevSecOps Champion

Barclays; New Jersey; On-site; USD 175,000 - 225,000; Full time

Benefits offered by this job

Medical, dental and vision coverage

401(k)

Life insurance

Paid leave

Job summary

Barclays’ Lead Application Security Analyst role in Whippany, NJ, drives the evaluation and delivery of Application Security and DevSecOps capabilities across the SDLC. The position requires expert knowledge of SAST/SCA/DAST, API security, secure coding practices and CI/CD integration in cloud-native environments.

You will translate security-testing data into actionable risk insights and collaborate with engineering, risk and governance stakeholders.

Qualifications

• Experience evaluating SAST/SCA/DAST tools and tuning policies.
• Knowledge of API security vulnerabilities and testing.
• Proficiency in at least one development ecosystem (Java/Spring, .NET, Go, Python or JavaScript/TypeScript).
• Integrates security testing into CI/CD pipelines and cloud-native environments (containers, Kubernetes, IaC).
• Ability to analyze data and present risk insights (KRI/KCI dashboards).
• Strong technical guidance to engineering teams on detailed application security risks.

Responsibilities

• Lead assessments, threat modeling and penetration activities; communicate findings to stakeholders.
• Collaborate with IT and engineering teams to identify new attack techniques and improve methods.
• Develop comprehensive reports with remediation guidance for senior stakeholders.
• Define security requirements across business processes and systems to strengthen posture.
• Develop testing methodologies for emerging vulnerabilities and assurance activities.

Skills

SAST tools

SCA tools

DAST tools

API security

CI/CD integration

Kubernetes

Secure coding practices

Threat modeling

Risk & governance

Technical communication

Tools

Java/Spring

.NET

Go

Python

JavaScript/TypeScript

CI/CD pipelines

Infrastructure as Code

Job description

Barclays’ Lead Application Security Analyst role in Whippany, NJ, drives the evaluation and delivery of Application Security and DevSecOps capabilities across the SDLC. The position requires expert knowledge of SAST/SCA/DAST, API security, secure coding practices and CI/CD integration in cloud-native environments.

You will translate security-testing data into actionable risk insights and collaborate with engineering, risk and governance stakeholders.