Remote Exposure Intelligence Analyst – Apps & APIs

allstate; United States; On-site; USD 100,000 - 171,000; Full time

Job summary

Allstate is seeking an Exposure Intelligence Analyst for Applications & APIs to identify and prioritize exposure risk across web apps and APIs. This SME role focuses on translating findings into actionable remediation alongside engineering teams to reduce exploitable exposure and improve secure patterns.

Responsibilities include analyzing auth flaws, insecure APIs, and weak session handling while applying CTEM principles to connect findings to real attack paths.

Qualifications

• 3+ years in application security, AppSec engineering, security operations, or exposure management.
• Understanding of web security fundamentals and common API/application attack patterns.
• Ability to translate technical findings into business risk and practical fixes.
• Experience with SAST/DAST tools and secure SDLC concepts.
• Familiarity with modern auth patterns (OAuth/OIDC), API gateways, and microservices.

Responsibilities

• Translate application findings into exposure intelligence and exploitability-based prioritization.
• Identify attack paths involving auth flaws, insecure APIs, weak session handling, and privilege boundaries.
• Produce clear remediation guidance and partner with app owners to validate closure.
• Collaborate with engineering teams to reduce exploitable exposure across applications and APIs.

Skills

API Security

Application Security

Web Security

Vulnerability Mgmt

Authentication

Secure SDLC

OWASP

Threat Modeling

Job description

Allstate is seeking an Exposure Intelligence Analyst for Applications & APIs to identify and prioritize exposure risk across web apps and APIs. This SME role focuses on translating findings into actionable remediation alongside engineering teams to reduce exploitable exposure and improve secure patterns.

Responsibilities include analyzing auth flaws, insecure APIs, and weak session handling while applying CTEM principles to connect findings to real attack paths.