Application Security Analyst

Key Responsibilities

• Assist in designing, reviewing, and implementing application security controls across card issuance, card management, and switch/transaction processing platforms.
• Conduct static (SAST), dynamic (DAST), and software composition (SCA) analysis, as well as manual secure code reviews, for applications supporting card and switch transactions.
• Support vulnerability assessments and penetration testing (web, API, mobile) for payment applications, POS/ATM integration layers, card management systems, and switch interfaces.
• Embed security checkpoints into the secure SDLC and CI/CD pipelines for fintech application development teams.
• Monitor application-layer security events and collaborate with SOC and Security Engineering teams to investigate anomalies affecting card/switch transaction flows.
• Support PCI-DSS compliance activities, including control validation, evidence gathering, and remediation tracking for in-scope applications.
• Review third-party and vendor integrations related to switch connectivity (e.g., ISO 8583 messaging, card network/scheme interfaces) for security risk.
• Participate in incident response for application-level security incidents impacting card or switch operations.
• Document findings, produce risk assessment reports, and work with engineering teams to track remediation to closure.
• Contribute to secure coding training and security awareness sessions for development teams.

Required Skills & Competencies

Technical & Functional Competencies

• Basic understanding of web and API security testing methodologies (OWASP Top 10, OWASP API Security Top 10).
• Basic understanding of card payment ecosystems card issuance/acquiring, switching, ISO 8583 messaging, EMV, and PCI-DSS requirements.
• Basic working knowledge of SAST/DAST/SCA tools (e.g., SonarQube, Checkmarx, Burp Suite, OWASP ZAP) and vulnerability scanners.
• Basic scripting ability (Python or Bash) to support security testing and automation.
• Basic exposure to cloud environments (AWS/Azure) and containerization (Docker/Kubernetes) security fundamentals.
• Basic understanding of secure SDLC, DevSecOps practices, and CI/CD security integration.
• Basic familiarity with IAM principles and encryption/key management concepts (e.g., HSM usage) within payment environments.
• Understanding how systems work deeply enough to predict how they can fail, curious mind willing to learn is an advantage, the space is fast evolving
• Understand attack paths, trust boundaries, abuse cases and business logic
• Knows how API is managed and can be abused like, HTTP, REST, GraphQL, OAuth/OIDC, JWT, sessions, cookies, CORS, WebSockets, microservices
• Able to action, Authentication, authorization, RBAC/ABAC, MFA, session management, privilege escalation
• Able use of tools like Burp Suite to conduct API testing, fuzzing, exploitation, business-logic testing is key
• Ability to conduct cloud security assessment AWS/Azure/GCP, containers, Kubernetes, IAM
• Reporting is key, every finding must be documented, like CVSS, exploitability, business impact, prioritization and remediation
• However simple, the person should be able to explain technical vulnerabilities to developers, architects, management and auditors, because we will keep having KSS
• Knowledge of scripting and automation is a plus, like Python, APIs, scripting, custom scanners and security tooling
• The person should be able read codes, C#, Python, JavaScript/TypeScript, Go, etc. and understand what the application does
• The person should be able to look at code and ask, what happens if I control this input, can I manipulate and see its reaction, where is authorization enforced exactly and what happens when this validation on control is bypassed?

Soft & Behavioral Skills

• Strong analytical and problem-solving skills, with the ability to assess risk in complex payment systems.
• Strong verbal and written communication skills, able to translate technical security risk into business terms for non-technical stakeholders.
• Strong sense of ownership and attention to detail when handling security findings in high-stakes, transaction-critical systems.
• Strong ability to work cross-functionally with engineering, risk, compliance, and fraud teams.
• Strong ability to perform under pressure and manage multiple priorities in a fast-paced fintech environment.

Preferred Qualifications

• Bachelor's degree in cyber/information security, computer science, information technology or any related discipline.

Experience

• 3 - 5 years of relevant experience in application security, penetration testing, or software security engineering, with prior exposure to fintech, banking, card processing, or payment switch environments considered a strong advantage.

Certifications

• CompTIA Security+ or equivalent foundational security certification (required or in progress).
• Certified Ethical Hacker (CEH) preferred.
• Offensive Security Certified Professional (OSCP) preferred, an advantage for hands-on testing roles.
• Certified Secure Software Lifecycle Professional (CSSLP) an advantage.
• PCI-DSS Implementer/Associate or related payment security certification an advantage given card/switch scope.
• Cloud security certification (e.g., AWS Certified Security – Specialty, Microsoft SC-200/AZ-500) an advantage.
• Working toward CISSP or equivalent a plus for career progression within the role.

<