应用安全分析师
Application Security Analyst
位置
远程-阿拉巴马州, 远程-佛罗里达州, 远程-佐治亚州, 远程-伊利诺伊州详情
Kemper 是国内领先的专门保险公司。我们的成功直接反映了那些每天为客户提供积极影响的才华横溢且多元化的人才。我们相信高绩效文化、个人发展和职业挑战的宝贵机会，以及健康的工作与生活平衡可以带来高度的激励和生产力。Kemper 的产品和服务正在真正改善客户的生活，这些客户有独特且不断变化的需求。通过加入我们的团队，您正在帮助为我们的利益相关者提供实现我们承诺的体验。
Kemper 保险正在招聘一名应用安全分析师。应用安全分析师会将安全融入软件开发生命周期，并对现代应用程序、API、云原生服务和软件供应链进行技术可信的应用安全评估。该职位直接与开发人员和架构师合作，以预防、识别、验证和修复可利用的应用程序风险。
主要职责
- 将安全需求和威胁建模整合到架构、设计、开发、测试、发布和例外处理流程中。
- 执行并验证 SAST、DAST、SCA、API、移动和手动安全测试；区分可利用的弱点与工具噪声。
- 对网页、API、云原生、容器化和分布式应用程序进行安全设计和架构审查。
- 与开发人员合作，提供代码级或设计级修复指导并验证关闭情况。
- 构建或改进 CI/CD 安全控制、扫描集成、安全编码标准和开发人员支持。
- 利用风险、可利用性、资产关键性和业务背景来优先处理应用程序漏洞和安全债务。
- 分析重复缺陷模式，并推动工程团队的预防性控制改进。
资格要求
- 具备应用安全测试、安全代码审查和漏洞验证的实际经验。
- 熟悉 OWASP Top 10/API 风险、认证/授权模式、会话管理、密码学基础、输入验证和常见的网络/应用攻击技术。
- 熟悉 SAST、DAST、SCA、API 测试、密钥扫描和 CI/CD 安全工具。
- 了解现代软件架构、REST/GraphQL API、容器化技术
查看英文原文
Location(s)
Remote-AL, Remote-FL, Remote-GA, Remote-ILDetails
Kemper is one of the nation’s leading specialized insurers. Our success is a direct reflection of the talented and diverse people who make a positive difference in the lives of our customers every day. We believe a high-performing culture, valuable opportunities for personal development and professional challenge, and a healthy work-life balance can be highly motivating and productive. Kemper’s products and services are making a real difference to our customers, who have unique and evolving needs. By joining our team, you are helping to provide an experience to our stakeholders that delivers on our promises.
Kemper Insurance is hiring an Application Security Analyst. The Application Security Analyst is one who embeds security into the software development lifecycle and performs technically credible application-security assessment across modern applications, APIs, cloud-native services, and software supply chains. The role partners directly with developers and architects to prevent, identify, validate, and remediate exploitable application risk.
Key Responsibilities
- Integrate security requirements and threat modeling into architecture, design, development, testing, release, and exception processes.
- Perform and validate SAST, DAST, SCA, API, mobile, and manual security testing; distinguish exploitable weaknesses from tool noise.
- Conduct security design and architecture reviews for web, API, cloud-native, containerized, and distributed applications.
- Partner with developers to provide code-level or design-level remediation guidance and verify closure.
- Build or improve CI/CD security controls, scanning integrations, secure coding standards, and developer enablement.
- Use risk, exploitability, asset criticality, and business context to prioritize application vulnerabilities and security debt.
- Analyze recurring defect patterns and drive preventive control improvements across engineering teams.
Qualifications
- Hands-on experience with application security testing, secure code review, and vulnerability validation.
- Strong knowledge of OWASP Top 10/API risks, authentication/authorization patterns, session management, cryptography fundamentals, input validation, and common web/application attack techniques.
- Working knowledge of SAST, DAST, SCA, API testing, secrets scanning, and CI/CD security tooling.
- Understanding of modern software architectures, REST/GraphQL APIs, containers, cloud services, and software supply-chain dependencies.
- Ability to engage developers at a technical level and provide actionable remediation guidance.
- Applied secure SDLC, threat modeling, architecture review, risk-based exception, and application-risk prioritization experience.
- Ability to translate exploitability into business impact and risk treatment decisions.
- Understanding ofsecurity-control objectives for application development and deployment.
- BS Computer Science, Software Engineering, Cybersecurity, Information Technology, or a related discipline, or equivalent relevant professional experience.
The range for this position is 93,500-155,500. When determining candidate offers, we consider experience, skills, education, certifications, and geographic location among other factors. This job is also eligible for our Kemper benefits package (Medical, Dental, Vision, PTO, 401K, etc.)
Kemper is proud to be an equal opportunity employer. All applicants will be considered for employment without attention to race, color, religion, sex, sexual orientation, gender identity, national origin, veteran, disability status or any other status protected by the laws or regulations in the locations where we operate. We are committed to supporting diversity and equality across our organization and we work diligently to maintain a workplace free from discrimination.
Kemper does not accept unsolicited resumes through or from search firms or staffing agencies. All unsolicited resumes will be considered the property of Kemper and Kemper will not be obligated to pay a placement fee.
Kemper will never request personal information, such as your social security number or banking information, via text or email. Additionally, Kemper does not use external messaging applications like WireApp or Skype to communicate with candidates. If you receive such a message, delete it.
Originally posted on Himalayas