Senior AppSec Analyst: Secure Web Apps & APIs

Minerva Cyber Tech; Columbia (MD); On-site; USD 120,000 - 170,000; Full time

Job summary

Minerva Cyber Technologies is seeking a Senior Application Security (AppSec) Analyst to assess the security of web applications, APIs, and software development workflows, then help engineering teams fix the vulnerabilities that matter. You will combine hands-on application security testing with clear remediation guidance and repeatable validation.

You will perform authorized application penetration testing, secure code review, and validation of automated scanner (SAST and DAST) findings.

Qualifications

• Senior-level hands-on experience in application security or secure testing.
• Understanding of OWASP Top 10 and modern authentication and session controls.
• Ability to read code and validate findings with security testing tools.
• Experience communicating fixes within approved test scope to developers.
• Willingness to travel to client sites as needed.
• Experience with Burp Suite and CI/CD pipeline security is a plus.

Responsibilities

• Review application designs, authentication, authorization, APIs, and sensitive-data handling.
• Perform authorized application penetration testing, secure code review, and validation of SAST/DAST findings.
• Explain exploitability, business impact, and remediation options clearly.
• Work with developers to integrate security checks into build, release, and change workflows (DevSecOps).
• Retest fixes and produce reproducible findings, evidence, and concise risk summaries.

Skills

Secure application security

OWASP Top 10

Code reading

DevSecOps collaboration

Tools

Burp Suite

Application scanners

CI/CD security

Container security

Job description

Minerva Cyber Technologies is seeking a Senior Application Security (AppSec) Analyst to assess the security of web applications, APIs, and software development workflows, then help engineering teams fix the vulnerabilities that matter. You will combine hands-on application security testing with clear remediation guidance and repeatable validation.

You will perform authorized application penetration testing, secure code review, and validation of automated scanner (SAST and DAST) findings.