Remote DevSecOps: Application Security Analyst

EMCOR Group; Phoenix (AZ); Remote; USD 98,000 - 116,000; Full time

Job summary

EMCOR Group, Inc. seeks an Application Security Analyst to advance its Security Program by integrating AppSec tools into CI/CD pipelines, managing vulnerabilities and partnering with development teams.

This role supports maturing DevSecOps practices across EMCOR’s environments. The position emphasizes reducing the attack surface, strengthening the Information Security Program, and collaborating with IT to tune WAFs, review Terraform IaC for security, and respond to incidents.

Qualifications

• 3+ years of hands-on experience in an Application Security, Product Security, DevOps or DevSecOps role.
• Experience with cloud platforms (Azure, AWS, GCP, OCI).
• Experience with CI/CD and developer workflow automation such as GitHub Actions, Azure DevOps Pipelines.
• Experience developing or reviewing Terraform used to deploy Azure infrastructure, including reusable modules.
• Experience managing and tuning Web Application Firewall (WAF) policies, specifically for Azure Front Door.
• Experience triaging and remediating vulnerabilities identified by GHAS or Defender for Cloud (CodeQL, Secret Scanning, Dependency Review).
• Proficient in PowerShell for administration and automation.
• Strong communication and project management capabilities.

Responsibilities

• Support and monitor the enterprise information security system as directed by management.
• Manage daily operations and support for Application Security products, including incident and ticket resolution.
• Provide expertise during incidents, document findings and help improve protocols.
• Maintain and upgrade application security related platforms.
• Tune application security related policies and rulesets.
• Collaborate with business and IT partners to integrate security tools into CI/CD pipelines and workloads.
• Contribute to and perform security reviews of Terraform configurations and reusable modules supporting Infrastructure as Code (IaC).
• Validate Terraform changes for security, compliance and alignment with cloud standards.
• Monitor code platforms and resources for security threats, investigate and respond to security incidents and findings.
• Write SIEM queries and perform analysis of results.
• Respond to security tool findings and collaborate with partners for remediation.
• Implement, configure, manage and support Web Application Firewalls (WAFs) including tuning of rulesets and policies.

Skills

Application Security

DevSecOps

Communication skills

Project management

Team collaboration

Tools

GitHub Actions

Azure DevOps Pipelines

Terraform

GHAS

PowerShell

WAF management (Azure Front Door)

Job description

EMCOR Group, Inc. seeks an Application Security Analyst to advance its Security Program by integrating AppSec tools into CI/CD pipelines, managing vulnerabilities and partnering with development teams.

This role supports maturing DevSecOps practices across EMCOR’s environments. The position emphasizes reducing the attack surface, strengthening the Information Security Program, and collaborating with IT to tune WAFs, review Terraform IaC for security, and respond to incidents.