[Remote] Application Security Analyst

Note: The job is a remote job and is open to candidates in USA. Sound Physicians is a nationally respected, physician-led medical group practicing in 400+ hospitals across 45 states. The Application Security Analyst helps embed security into the software delivery lifecycle by partnering with development, platform, cloud, and security teams to build secure-by-default processes, focusing on reducing risk through automation and continuous testing.

Responsibilities

• Integrate security controls and automated checks into CI/CD pipelines, including Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), secret scanning, container security scanning, and Infrastructure-as-Code (IaC) validation
• Partner with developers and platform engineers to identify, prioritize, and remediate application, API, container, and cloud security risks early in the development lifecycle
• Perform application security assessments, architecture reviews, and threat modeling exercises for new and existing applications
• Support vulnerability management by validating findings, reducing false positives, tracking remediation, and helping define risk-based service-level expectations
• Conduct secure code reviews and provide guidance on secure coding practices aligned with OWASP Top 10, CWE, and industry standards
• Perform security reviews for application architecture, deployment patterns, third-party components, and cloud configurations
• Develop and maintain secure pipeline standards, reusable guardrails, and policy-as-code checks that improve consistency without creating unnecessary delivery friction
• Collaborate with engineering, infrastructure, and security operations teams on incident response, root cause analysis, and hardening activities related to software delivery platforms
• Create and maintain documentation, standards, playbooks, and training materials related to application security, secure development, and DevSecOps practices
• Track vulnerability trends, security metrics, and recurring issues to improve security maturity across build, release, and runtime workflows
• Stay current on emerging threats, attack techniques, vulnerabilities, and security technologies relevant to application and cloud security

Skills

• Bachelor's degree in Computer Science, Information Security, or related field, with industry-recognized certifications such as CSSLP (Certified Secure Software Lifecycle Professional), GWAPT (GIAC Web Application Penetration Tester), OSWE (Offensive Security Web Expert), CEH (Certified Ethical Hacker)
• 4+ years of experience in application security, DevOps, cloud security, security engineering, or a related cybersecurity role
• Strong understanding of application security concepts, secure coding practices, and common attack vectors
• Knowledge of security testing methodologies including SAST, DAST, SCA, penetration testing, secret scanning, and IaC security assessments
• Familiarity with cloud platforms such as Azure and AWS
• Familiarity with CI/CD platforms such as Azure DevOps, GitHub Actions, GitLab CI, or Jenkins
• Knowledge of OWASP Top 10, OWASP API Security Top 10, MITRE ATT&CK, and NIST Cybersecurity Framework
• Experience with application security platforms such as Veracode, Checkmarx, Fortify, SonarQube, Snyk, Mend, Burp Suite, Rapid7 InsightAppSec, or similar tools
• Familiarity with scripting and automation using Python, Powershell, Bash, or similar languages
• Experience securing containerized applications and platforms (Docker, Kubernetes, OpenShift, AKS, EKS, or GKE), including container image scanning, runtime security monitoring, admission controls, and Kubernetes security best practices
• Knowledge of container technologies, source control workflows, and modern software delivery practices
• Familiarity with common static and dynamic application security tools
• Ability to analyze security findings, assess risk, and communicate remediation recommendations effectively to technical and non-technical stakeholders
• Familiarity with AI-assisted development processes and appropriate security controls
• Strong written and verbal communication skills
• Ability to translate technical issues into clear guidance and action plans
• Knowledge of cloud-native security controls
• Familiarity with Kubernetes, Terraform, and similar Infrastructure-as-Code tools
• Familiarity with secrets management, PKI, certificate management, and cryptographic controls
• Knowledge of compliance frameworks such as NIST CSF, NIST 800-53, HIPAA, PCI DSS, SOC 2, ISO 27001, and HITRUST
• Knowledge of scripting and programming languages such as Python, PowerShell, Java, JavaScript, C#, or Go is highly desirable and considered a plus
• Experience supporting regulated environments such as healthcare, financial services, or other compliance-driven industries

Benefits

• Medical insurance, Dental insurance, and Vision insurance
• Health care and dependent care flexible spending account
• 401(k) retirement savings plan with a company match
• Paid time off (PTO) begins accruing immediately upon start date at a rate of 15 days per year, in accordance with Sound's PTO policy
• Ten company-paid holidays per year
• Remote-first culture that values flexibility and collaboration
• Participation in the after-hours security incident response and on-call rotation is part of the role.

Company Overview

Company H1B Sponsorship