Senior Application Security Analyst
Confirmed on the employer's own hiring board on Oct 27, 2026. First seen by Alion on Oct 27, 2026.
We are looking for a Senior Application Security Analyst to lead complex application-security investigations and improve the services, processes, and practices used to manage application risk.
You will handle high-complexity incidents and vulnerability cases, guide other analysts, coordinate investigations across multiple stakeholders, and drive improvements to runbooks, telemetry, alert quality, and operational performance.
Main responsibilities:
Complex investigations and incident leadership
- Lead high-complexity investigations involving applications, APIs, authentication systems, and internet-facing services
- Form and test investigation hypotheses by correlating telemetry across multiple systems and data sources
- Establish incident scope, timeline, root cause, attack path, affected assets, and potential business impact
- Coordinate evidence gathering, analysis, handovers, and specialist contributions during significant incidents
- Recommend containment and risk-reduction actions and provide clear technical context for decision-makers
- Review investigation quality, risk assessments, and closure decisions for significant cases.
- Participate in or lead incident-response duties where required.
Advanced vulnerability analysis
- Lead the validation and prioritization of complex or high-impact findings from security testing, bug bounty, incident response, and external disclosures
- Assess exploitability, attack chains, exposure, asset criticality, affected data, and compensating controls
- Identify patterns across incidents and vulnerabilities and recommend measures that address recurring root causes
- Resolve ambiguous or disputed findings by presenting clear evidence and risk-based reasoning
Guide stakeholders through difficult prioritization, escalation, and risk-acceptance decisions.
Service and process improvement
- Own and improve investigation procedures, runbooks, escalation paths, quality standards, and case-review practices
- Identify gaps in telemetry and investigation capability and define clear requirements for the teams responsible for addressing them
- Drive improvements to alert fidelity, investigation efficiency, reporting quality, and operational coverage
- Develop advanced scripts, queries, and analytical methods for complex investigations and recurring use cases
- Lead tabletop exercises, case reviews, and post-incident improvement activities
- Use operational metrics and investigation outcomes to prioritize service improvements.
Technical leadership and collaboration
- Act as a senior subject-matter expert for application-security investigations and vulnerability analysis
- Mentor analysts and improve team capability through coaching, peer review, and knowledge sharing
- Communicate complex technical findings and uncertainty clearly to technical and non-technical stakeholders
- Coordinate work across application owners, incident responders, security specialists, and leadership
- Represent the application-security analysis function in complex cross-team discussions.
- 5-8 years of relevant experience in application security, incident response, security operations, vulnerability research, penetration testing, or a related cybersecurity role
- Extensive experience leading complex security investigations using SIEM and other telemetry platforms
- Advanced ability to correlate data across multiple sources, reconstruct attack timelines, and determine root cause and business impact
- Deep understanding of web application and API security, common attack techniques, and defensive controls
- Strong experience validating complex vulnerabilities, attack chains, and evidence of exploitation
- Advanced proficiency with web-security and investigation tools such as Burp Suite, OWASP ZAP, Elastic, Splunk, or equivalent platforms
- Strong scripting capability in Python, Bash, or a similar language for investigation and operational automation
- Demonstrated experience creating and improving runbooks, analytical methods, and incident-response processes
- Strong critical-thinking skills and the ability to make risk-based decisions with incomplete or ambiguous information
- Demonstrated ability to lead investigations, mentor analysts, and influence stakeholders across organizational boundaries
- Excellent written and verbal communication skills.
Preferred qualifications
- Experience with large-scale WAF, CDN, API gateway, authentication, cloud, or application telemetry
- Experience with threat hunting, digital forensics, incident command, or purple-team activities
- Experience developing investigation metrics, quality controls, or operational service reviews
- Familiarity with CVSS, OWASP risk-rating methods, CWE, MITRE ATT&CK, or equivalent frameworks
- Relevant certifications such as GCIH, GCIA, GWAPT, GXPN, OSCP, OSWE, or equivalent practical experience.
What success looks like
- Complex incidents and vulnerabilities are handled with clear technical leadership and sound risk decisions
- Investigations produce defensible conclusions on scope, impact, root cause, and required action
- Analysts receive effective technical guidance and improve their independence over time
- Runbooks, analytical methods, and quality standards improve based on operational evidence
- Alert quality and investigation efficiency show measurable improvement
- Senior stakeholders receive clear, timely, and decision-ready security analysis.
This job description outlines the general nature and level of work performed by employees within this classification and is not intended to be a comprehensive inventory of all duties and responsibilities. Additionally, the responsibility to possess the necessary employment documents for this country rests with the candidate.
What we offer:
You will find here not only an environment where you can do meaningful work and feel supported, but also a benefits package designed to foster your growth and wellbeing:
- Soft skills and technical training for current and emerging products and technologies
- Mentoring programs that connect you with mentors from around the world
- Employee Assistance Programs to support your wellbeing, both personally and professionally
- Career development opportunities to grow within the team
- Special referral bonuses for recommending friends
- A friendly team eager to welcome you.
About us:
Stefanini is a Brazilian multinational company with 39 years of experience and presence in 41 countries. With more than 35,000 employees, we co-create solutions for a better future, driving digital transformation with a focus on real results.
We operate in an integrated way through 7 specialized business units: Consulting (Technology and Business Agility), Analytics & AI, Banking & Payments, Cybersecurity, Manufacturing 4.0, and Digital Marketing. We are a group that breathes collaboration and offers a dynamic environment where you will learn by doing, grow alongside the team, and have space to contribute with ideas and projects.
If you are looking for a place to develop, innovate, and be part of something bigger, then Stefanini is your place.
Our commitment to inclusion and fairness:
At Stefanini, we are fostering a workplace where it is safe to express oneself and everyone is treated with dignity, respect, and fairness. We welcome people of all backgrounds, regardless of race, ethnicity, color, nationality, gender, gender identity or expression, sexual orientation, age, religion, belief and disability.
Every individual is encouraged to be their authentic self, as diverse perspectives strengthen our teams, drive innovation, and contribute to our success.
Our recruitment process is designed to be fair, consistent, and inclusive. We act in a transparent and fair manner in our employment practices, ensuring that all employees receive equitable compensation for their contributions, regardless of their background.
What's next:
It's best to apply today, because job postings can be taken down and we wouldn't want you to miss this opportunity. In case you need further information, just send us a message at [email protected] and we'll be happy to assist!
- 5-8 years of relevant experience in application security, incident response, security operations, vulnerability research, penetration testing, or a related cybersecurity role
- Extensive experience leading complex security investigations using SIEM and other telemetry platforms
- Advanced ability to correlate data across multiple sources, reconstruct attack timelines, and determine root cause and business impact
- Deep understanding of web application and API security, common attack techniques, and defensive controls
- Strong experience validating complex vulnerabilities, attack chains, and evidence of exploitation
- Advanced proficiency with web-security and investigation tools such as Burp Suite, OWASP ZAP, Elastic, Splunk, or equivalent platforms
- Strong scripting capability in Python, Bash, or a similar language for investigation and operational automation
- Demonstrated experience creating and improving runbooks, analytical methods, and incident-response processes
- Strong critical-thinking skills and the ability to make risk-based decisions with incomplete or ambiguous information
- Demonstrated ability to lead investigations, mentor analysts, and influence stakeholders across organizational boundaries
- Excellent written and verbal communication skills.
Preferred qualifications
- Experience with large-scale WAF, CDN, API gateway, authentication, cloud, or application telemetry
- Experience with threat hunting, digital forensics, incident command, or purple-team activities
- Experience developing investigation metrics, quality controls, or operational service reviews
- Familiarity with CVSS, OWASP risk-rating methods, CWE, MITRE ATT&CK, or equivalent frameworks
- Relevant certifications such as GCIH, GCIA, GWAPT, GXPN, OSCP, OSWE, or equivalent practical experience.
What success looks like
- Complex incidents and vulnerabilities are handled with clear technical leadership and sound risk decisions
- Investigations produce defensible conclusions on scope, impact, root cause, and required action
- Analysts receive effective technical guidance and improve their independence over time
- Runbooks, analytical methods, and quality standards improve based on operational evidence
- Alert quality and investigation efficiency show measurable improvement
- Senior stakeholders receive clear, timely, and decision-ready security analysis.
This job description outlines the general nature and level of work performed by employees within this classification and is not intended to be a comprehensive inventory of all duties and responsibilities. Additionally, the responsibility to possess the necessary employment documents for this country rests with the candidate.
What we offer:
You will find here not only an environment where you can do meaningful work and feel supported, but also a benefits package designed to foster your growth and wellbeing:
- Soft skills and technical training for current and emerging products and technologies
- Mentoring programs that connect you with mentors from around the world
- Employee Assistance Programs to support your wellbeing, both personally and professionally
- Career development opportunities to grow within the team
- Special referral bonuses for recommending friends
- A friendly team eager to welcome you.
About us:
Stefanini is a Brazilian multinational company with 39 years of experience and presence in 41 countries. With more than 35,000 employees, we co-create solutions for a better future, driving digital transformation with a focus on real results.
We operate in an integrated way through 7 specialized business units: Consulting (Technology and Business Agility), Analytics & AI, Banking & Payments, Cybersecurity, Manufacturing 4.0, and Digital Marketing. We are a group that breathes collaboration and offers a dynamic environment where you will learn by doing, grow alongside the team, and have space to contribute with ideas and projects.
If you are looking for a place to develop, innovate, and be part of something bigger, then Stefanini is your place.
Our commitment to inclusion and fairness:
At Stefanini, we are fostering a workplace where it is safe to express oneself and everyone is treated with dignity, respect, and fairness. We welcome people of all backgrounds, regardless of race, ethnicity, color, nationality, gender, gender identity or expression, sexual orientation, age, religion, belief and disability.
Every individual is encouraged to be their authentic self, as diverse perspectives strengthen our teams, drive innovation, and contribute to our success.
Our recruitment process is designed to be fair, consistent, and inclusive. We act in a transparent and fair manner in our employment practices, ensuring that all employees receive equitable compensation for their contributions, regardless of their background.
What's next:
It's best to apply today, because job postings can be taken down and we wouldn't want you to miss this opportunity. In case you need further information, just send us a message at [email protected] and we'll be happy to assist!