Senior IT Security Auditor - AppSec & Cloud DevSecOps Lead

vTech Solution; Michigan; Hybrid; USD 90,000 - 130,000; Full time

Job summary

vTech Solution is seeking an experienced IT Security Auditor to strengthen secure coding, assess applications, and improve API and cloud security within a hybrid enterprise environment. You will collaborate with development teams to embed secure practices across web, mobile, and cloud applications.

The role requires hands-on experience with SAST/DAST/SCA tools, knowledge of OWASP Top 10, API security, JWT/OAuth/OIDC, and CI/CD security automation. A CJIS background check is required.

Qualifications

• 5+ years of total IT experience
• 3+ years in application security, secure development, or security auditing
• Hands-on experience with SAST, DAST, SCA, ASOC, container, and cloud security tools
• Strong knowledge of OWASP Top 10, API Security, JWT, OAuth, OIDC, and PKCE
• Experience with Angular, React, Node.js, Java, Spring Boot, or .NET
• Knowledge of HTTP request/response headers and secure application development
• Ability to pass a CJIS background check

Responsibilities

• Conduct application security assessments using SAST, DAST, SCA, ASOC, and related tools
• Partner with software development teams on secure coding practices
• Review HTTP request/response headers, web traffic, and API security risks
• Identify and help remediate OWASP Top 10 vulnerabilities
• Support DevSecOps, security automation, and continuous compliance efforts
• Strengthen secure development practices across web, mobile, and cloud applications

Skills

Security auditing

Application security

Secure development

Secure coding practices

OWASP Top 10

API security

JWT/OAuth/OIDC/PKCE

Web/mobile cloud security

DevSecOps

Tools

Coverity

BlackDuck

Fortify

SAST tools

DAST tools

Job description

vTech Solution is seeking an experienced IT Security Auditor to strengthen secure coding, assess applications, and improve API and cloud security within a hybrid enterprise environment. You will collaborate with development teams to embed secure practices across web, mobile, and cloud applications.

The role requires hands-on experience with SAST/DAST/SCA tools, knowledge of OWASP Top 10, API security, JWT/OAuth/OIDC, and CI/CD security automation. A CJIS background check is required.