{"id":2007103,"url":"https://alion.io/job/buy-the-way-application-security-product-security-analyst-cdi","title":"Application Security / Product Security Analyst – CDI","company":{"id":3908514,"name":"Buy The Way","domain":"buy-the-way.com","url":"https://alion.io/company/buy-the-way","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":null,"truth_index":null},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Caen, France"],"countries":["FR"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":42000,"max":45000,"currency":"EUR","period":"year","gross":null,"usd_annual":50637},"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Composer","optional":false},{"name":"CVSS","optional":false},{"name":"Git","optional":false},{"name":"GitHub","optional":false},{"name":"ITSM","optional":false},{"name":"JavaScript","optional":false},{"name":"LDAP","optional":false},{"name":"MySQL","optional":false},{"name":"npm","optional":false},{"name":"OWASP","optional":false},{"name":"PHP","optional":false},{"name":"Rest API","optional":false},{"name":"Symfony","optional":false},{"name":"Vue.js","optional":false}],"status":"live","first_seen_at":"2026-10-05T15:19:18Z","employer_posted_date":null,"last_verified_at":"2026-10-05T15:19:18Z","board_verified":false,"closed_at":null,"days_open":24,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":24},"description":"Nous recherchons un(e) Application Security / Product Security Analyst pour rejoindre l’équipe en charge de GLPI, une solution ITSM open source utilisée par des organisations partout dans le monde.\nL’objectif du poste : analyser les vulnérabilités qui concernent le produit, comprendre leur origine et leur impact, puis accompagner les développeurs dans leur résolution.\nTes missionsTu interviendras principalement sur :\nl’analyse et la reproduction des vulnérabilités ;\n\nl’identification des vecteurs d’attaque et des composants concernés ;\n\nl’évaluation de leur exploitabilité, impact et criticité ;\n\nla création de PoC et la documentation des scénarios de reproduction ;\n\nl’analyse du code, des flux applicatifs, API et dépendances ;\n\nla recherche de vulnérabilités similaires dans le produit ;\n\nla qualification via CWE, OWASP et CVSS ;\n\nla revue de code orientée sécurité ;\n\nl’analyse des dépendances et CVE ;\n\nles tests de non-régression après correction ;\n\nl’amélioration progressive des contrôles de sécurité dans le cycle de développement.\n\nTu travailleras directement avec les développeurs en leur apportant les informations nécessaires pour comprendre et corriger efficacement les vulnérabilités identifiées.\nL’objectif est également de prendre du recul sur les incidents rencontrés afin d’identifier les problèmes récurrents et de renforcer durablement la sécurité du produit.\nEnvironnement techniqueApplication web open source complexe principalement développée en :\nPHP 8.2+ · Symfony · JavaScript · Vue.js · MySQL/MariaDB\nEnvironnement : Git/GitHub · Composer/npm · API REST · OAuth2 · LDAP · plugins\nPratiques sécurité : SAST · SCA · DAST · pentest applicatif · PoC · CVE · CWE · OWASP · CVSS · Secure Code Review\nProfil recherché\nNous recherchons un profil avec environ 3 ans d’expérience en sécurité applicative / AppSec / Product Security.\nTu as une bonne compréhension des applications web et tu es capable de naviguer dans une base de code importante, suivre les flux applicatifs et comprendre les mécanismes d’authentification, d’autorisation, d’accès aux données et d’exposition via les API.\nUne expérience en analyse de vulnérabilités, pentest web, revue de code sécurité ou sécurité des API sera particulièrement appréciée.\nLa connaissance de PHP/Symfony est un plus.","description_format":"text","description_chars":2292,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security"],"lifecycle":[{"event":"open","at":"2026-10-07T12:33:56Z"}],"visa":[],"liveness":{"score":36,"band":"fade","label":"Fading","p_open":0.85,"p_active":0.77,"p_room":0.55,"age_days":24,"expected_fill_days":24,"reasons":["seen:24","velocity","win:tail"],"computed_at":"2026-10-30T05:48:23Z"},"pay":{"stated_usd_annual":50637,"is_top_pay":false},"html_url":"https://alion.io/job/buy-the-way-application-security-product-security-analyst-cdi","json_url":"https://alion.io/job/buy-the-way-application-security-product-security-analyst-cdi.json","meta":{"generated_at":"2026-10-30T11:47:32Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":16917,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-31T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":3908514},"rest":"https://alion.io/mcp/rest/get_company?id=3908514"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fbuy-the-way-application-security-product-security-analyst-cdi"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fbuy-the-way-application-security-product-security-analyst-cdi"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fbuy-the-way-application-security-product-security-analyst-cdi"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/buy-the-way-application-security-product-security-analyst-cdi\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fbuy-the-way-application-security-product-security-analyst-cdi"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":2007103}},{"tool":"search_jobs","arguments":{"company":"buy-the-way.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":2007103},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}