Application Security Analyst I

About the Role:

At IQVIA, protecting healthcare applications, sensitive client information, and Protected Health Information (PHI) is a critical responsibility. The Application Security Analyst I plays an important role in supporting the security of applications, APIs, cloud-native platforms, and software delivery pipelines.

Working closely with Application Development, DevOps, Infrastructure, and Security teams, you will help identify and assess application security risks, support vulnerability remediation efforts, maintain application security records, and contribute to secure software development practices. This role provides hands-on experience with application security testing, vulnerability management, Secure SDLC activities, and modern application security technologies. You will have the opportunity to develop expertise in application security while helping ensure security and compliance across healthcare technology platforms that support our clients and members.

Ideal Candidate:

The ideal candidate is an early-career Application Security professional who is passionate about securing applications and helping development teams build secure software. You have a strong foundation in web application security, vulnerability management, and secure development practices, and you're eager to expand your expertise in modern technologies such as cloud-native applications, APIs, containers, CI/CD pipelines, and AI-enabled solutions. You enjoy investigating security issues, collaborating with developers to resolve vulnerabilities, and balancing security requirements with business needs. Strong analytical thinking, attention to detail, effective communication skills, and a continuous learning mindset will be key to success in this role.

Major Responsibilities:

• Support and administer application security tools including SAST, SCA, DAST, API security, secrets scanning, container scanning, and Infrastructure-as-Code (IaC) security solutions.
• Validate security findings, assess potential impact, prioritize vulnerabilities, and support remediation efforts through verified closure.
• Perform targeted security testing of web applications, APIs, authentication and authorization controls, file handling functions, business logic, and data flows.
• Execute application security testing activities required through Secure SDLC and AI Development Lifecycle (AIDLC) processes while maintaining supporting evidence and documentation.
• Provide developers with remediation guidance based on scanning results, security testing findings, code reviews, and security incidents.
• Support monitoring of software supply chain risks including third-party dependencies, repositories, CI/CD credentials, artifact integrity, and software bills of materials (SBOMs).
• Assist in maintaining the application catalog by onboarding applications, validating ownership information, and ensuring inventory records remain accurate.
• Maintain application security profiles including data sensitivity, security-tool coverage, testing records, findings, and risk information.
• Help validate that required security scans, reviews, and testing activities are completed before software releases.
• Support security reviews of AI-generated code and AI-enabled applications, including testing for prompt injection, data leakage, insecure outputs, authorization weaknesses, and improper use of sensitive information.
• Produce security metrics, testing evidence, remediation reports, and compliance-related documentation.
• Escalate complex technical risks, architectural concerns, and design-related security issues to senior application security team members when required.

Required Experience and Qualifications:

• Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Technology, Software Engineering, or a related field, or equivalent experience.
• 1-3 years of experience in Application Security, Security Engineering, DevSecOps, Software Development, Penetration Testing, or a related cybersecurity discipline.
• Hands-on experience with SAST, SCA, DAST, API security testing, container security, vulnerability management, or similar application security technologies.
• Familiarity with application security tools such as Veracode, Wiz, Sysdig, Burp Suite, Postman, or equivalent platforms.
• Working knowledge of web security, API security, authentication, authorization, secure coding, cryptography, and software supply chain security.
• Experience supporting Secure SDLC, CI/CD pipelines, Git workflows, security testing, and release security controls.
• Knowledge of OWASP Top 10, OWASP API Security Top 10, MITRE CWE, NIST SSDF, HIPAA, HITRUST, SOC 2, and related security frameworks.
• Strong analytical, communication, documentation, and reporting skills.
• Fluent in written and verbal English.

Preferred Qualifications:

• Exposure to security tools such as Veracode, Wiz, Sysdig, Burp Suite, Postman, or similar application security platforms.
• Experience with healthcare SaaS platforms, PHI processing environments, cloud-native applications, containers, or multi-tenant platforms.
• Working knowledge of Python, Java, JavaScript/TypeScript, or C# from a development, automation, or code review perspective.
• Security certifications such as CompTIA Security+, CSSLP, AWS Certification, GWAPT, GWEB, or equivalent application security credentials.

IQVIA is a leading global provider of clinical research services, commercial insights and healthcare intelligence to the life sciences and healthcare industries. We create intelligent connections to accelerate the development and commercialization of innovative medical treatments to help improve patient outcomes and population health worldwide. Learn more at https://jobs.iqvia.com

IQVIA is committed to integrity in our hiring process and maintains a zero tolerance policy for candidate fraud. All information and credentials submitted in your application must be truthful and complete. Any false statements, misrepresentations, or material omissions during the recruitment process will result in immediate disqualification of your application, or termination of employment if discovered later, in accordance with applicable law. We appreciate your honesty and professionalism.