Principal Application Security Analyst

Cybersecurity Jobs; Madison (WI); Hybrid; USD 135,000 - 165,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Telehealth services

401(k) with match

Paid time off

Professional development

Job summary

Cybersecurity Jobs in Wisconsin seeks a Principal Application Security Analyst to design and run the enterprise application security program across the software development lifecycle, reducing risk through testing, triage, and developer enablement.

The role sits within the Cyber Threat Management team and collaborates with Cyber Trust & Architecture to translate security standards into practical testing criteria and actionable guidance for engineers.

Qualifications

• U.S. Citizenship required due to DoD restrictions.
• Bachelor’s degree or equivalent in cybersecurity/CS/IT.
• 5+ years of progressive experience in application security or related.
• Hands-on experience with SAST and DAST testing.
• Knowledge of OWASP Top 10 and MITRE ATT&CK.

Responsibilities

• Build and operate the enterprise Application Security program across the SDLC.
• Engage developers to support secure coding and triage findings.
• Translate security standards into practical testing criteria.
• Coordinate remediation of vulnerabilities with developers and owners.
• Provide risk-based reporting to technical, managerial, and executive audiences.
• Collaborate with Cyber Trust & Architecture on standards interpretation.

Skills

5+ years in application security

Strong communication skills

Problem solving

Education

Bachelor’s degree in Cybersecurity, Computer Science, Software Engineering, IT, Information Systems, or related field

Tools

SAST

DAST

SCA

API security testing tools

Job description

The Principal Application Security Analyst will design and run WPS’s enterprise application security program with a focus on reducing application risk across the SDLC. This individual-contributor role sits within the Cyber Threat Management team and combines application security testing, triage, developer enablement, and risk-focused reporting.

Role Overview

This position builds and operates the enterprise Application Security program, using secure-development standards to improve application risk posture throughout the software development lifecycle. The analyst manages day-to-day application-security testing and triage, engages developers to support secure coding, and helps translate enterprise security requirements into practical testing criteria.

Key Responsibilities

• Build and operate WPS’s enterprise Application Security program to reduce application risk by operationalizing secure-development standards, strengthening developer secure-coding practices, running application-security testing tools, and reporting outcomes to technical, managerial, and executive audiences.
• Partner with Cyber Trust & Architecture to translate enterprise security standards into developer guidance and actionable testing criteria.
• Work independently with developers to interpret application security findings and communicate risk across multiple levels of the organization.
• Manage day-to-day application-security testing, triage, and developer engagement independently, while collaborating with Cyber Trust & Architecture on standards interpretation and with the Manager, Cyber Threat Management on program priorities.
• Operationalize secure-development standards by strengthening secure-coding practices, executing application-security testing using approved tooling, and providing reporting to technical, managerial, and executive stakeholders.
• Coordinate remediation of application vulnerabilities with developers and system owners, prioritize using actual exploitability and business risk, and validate fixes through retesting.

Required Qualifications

• U.S. Citizenship required due to Department of Defense restrictions.
• Bachelor’s degree in Cybersecurity, Computer Science, Software Engineering, Information Technology, Information Systems, or a related field, or an equivalent combination of education and relevant work experience.
• 5 or more years of progressive experience in application security, software security, DevSecOps, or a related technical security discipline.
• Hands-on experience with application-security testing technologies such as SAST and DAST, including the ability to tune tools, independently validate findings, and translate cybersecurity standards and technical requirements into developer guidance and secure-coding training.
• Proficient knowledge of common application vulnerabilities and attack techniques, potentially including Authentication / Authorization, Injection, Session management, API security, insecure dependencies, and related topics.
• Knowledge of modern software development methodologies, CI/CD pipelines, APIs, and cloud-based application environments to integrate security testing into the development lifecycle.
• Strong analytical skills to distinguish exploitable vulnerabilities from false positives and prioritize remediation based on actual risk.
• Strong communication, problem solving, and decision-making skills.
• Wired (ethernet cable) internet connection from your router to your computer, with high speed cable or fiber and minimum internet performance of 10 Mbps downstream and 1 Mbps upstream (verifiable at https://speedtest.net).
• Please review Remote Worker FAQs: https://secure.wpsic.com/files/remote-work-faqs.pdf.

Preferred Qualifications

• Knowledge of OWASP Top 10, OWASP API Security Top 10, CWE, CVSS, and MITRE ATT&CK.
• Professional certification such as CSSLP, GWAPT, GWEB, or OSWE.

Technologies

• SAST, DAST, SCA
• API and secrets scanning
• CI/CD pipelines, APIs, cloud-based application environments
• OWASP Top 10, OWASP API Security Top 10, CWE, CVSS
• MITRE ATT&CK
• CSSLP, GWAPT, GWEB, OSWE

Work Location

• Hybrid work available; employees should live within the state of Wisconsin.
• Employees within 45 miles of WPS Headquarters (1717 W. Broadway in Madison, WI, 53713) are expected to work in office 3 days per week on a regular basis.

Compensation and Benefits

• Salary: USD 135,000 - 165,000 per yearly
• Remote and hybrid work options available
• Performance bonus and/or merit increase opportunities
• 401(k) with a 100% match for the first 3% of your salary and a 50% match for the next 2% of your salary (100% vested immediately)
• Competitive paid time off
• Health insurance, dental insurance, and telehealth services start DAY 1
• Professional and Leadership Development Programs
• Additional benefits available at: https://www.wpshealthsolutions.com/careers/

How You Know This Role Fits

• Operate, tune, and continuously improve enterprise application security testing capabilities (SAST, DAST, SCA, API and secrets scanning), distinguishing exploitable vulnerabilities from false positives and integrating testing into the development and CI/CD lifecycle.
• Translate enterprise application-security standards and secure-by-design requirements into practical developer guidance, testing criteria, and implementation practices across the software-development lifecycle with Cyber Trust & Architecture.
• Develop and deliver developer-focused secure-coding education using real vulnerability trends and hands-on guidance to help developers meet enterprise security standards.
• Create and maintain technical, managerial, and executive reporting that converts application-security findings, vulnerability trends, and standards adoption into actionable, risk-based information.
• Coordinate vulnerability remediation with developers and system owners by prioritizing based on exploitability and business risk, then validate fixes through retesting.
• Apply current threat intelligence and attacker techniques to application-security testing and priorities in partnership with Cyber Trust & Architecture, Cyber Risk & Assurance, and development teams.