Application Security Analyst

Our mission is to help people integrate technology into everyday life and to enable innovation through technology. We offer software development and infrastructure solutions, with advanced competences in Blockchain, Artificial Intelligence and Machine Learning. All our offices (in Western Europe or nearshore, in CEE) are located within the boundaries of the European Union. We believe working in close cooperation with our clients and employees is the key to success; this means we offer people the best working environment in order to achieve the best results. We love entrepreneurial spirits and encourage people around us to be proactive and make the best decisions not only for business, but for their own personal development. Our nearshore Romanian offices are in Bucharest (Victoriei Square) and Iasi (Palace) and, with over 9000 team members at group level, we make sure we are always close to our customers.

Role Overview:

We are looking for an Application Security Analyst to identify, investigate, and help reduce security risks affecting our applications and APIs.

You will independently triage alerts, investigate potential incidents, validate vulnerabilities, and communicate risk to relevant stakeholders. You will also improve runbooks and write scripts that make recurring analysis and response work faster and more consistent

Key Responsibilities:

Security monitoring and incident response

• Monitor and triage application-security alerts from SIEM, WAF, application, API, and related telemetry.
• Independently validate alerts, gather evidence, identify affected assets, assess potential impact, and assign priorities.
• Investigate incidents by correlating logs, reconstructing timelines, testing hypotheses, and identifying suspicious or malicious activity.
• Determine incident scope and likely impact and recommend immediate containment or risk-reduction actions.
• Maintain accurate records covering evidence, decisions, risk assessments, handovers, and escalation context.
• Escalate complex forensic analysis and remediation activities to the appropriate specialists.
• Participate in an incident-response rota or other agreed response duties where required.

Vulnerability analysis and triage

• Triage findings from security tools, penetration tests, bug bounty reports, incident investigations, and external disclosures.
• Validate whether vulnerabilities are reproducible and determine whether there is evidence of exploitation.
• Prioritise findings using severity, exploitability, exposure, affected data, business criticality, and compensating controls.
• Produce actionable findings that explain the issue, evidence, potential business impact, priority, and recommended next steps.
• Track remediation, ageing, exceptions, recurrence, and risk decisions through closure.
• Identify recurring vulnerability patterns and recommend improvements to procedures, guidance, or detection coverage.

Runbooks, scripting, and process improvement

• Write, maintain, and test runbooks, standard operating procedures, investigation checklists, query guides, and handover procedures.
• Write Python, Bash, or similar scripts to automate repetitive analysis, data enrichment, evidence collection, alert validation, and reporting.
• Review investigations to identify gaps in procedures, telemetry, and escalation paths.
• Improve alert quality by documenting false-positive patterns, missing context, and tuning opportunities.
• Participate in tabletop exercises, case reviews, and post-incident improvement activities.
• Support less-experienced analysts through peer review and practical knowledge sharing.

Reporting and stakeholder collaboration

• Communicate investigation results and security risks clearly to technical and non-technical stakeholders.
• Work with application owners and specialists to validate findings, agree next steps, and track risks through closure.
• Produce metrics and reports covering alert volumes, investigation outcomes, vulnerability trends, and remediation performance

Requirements:

• 3–5 years of relevant experience in application security, security operations, incident response, vulnerability management, penetration testing, or a related cybersecurity role.
• Practical experience investigating security alerts and incidents using SIEM or log-management platforms.
• Ability to correlate telemetry from multiple sources and establish incident scope, timeline, and likely impact.
• Strong understanding of web application and API security, including the OWASP Top 10 and common attack techniques.
• Experience validating and prioritising findings from SAST, DAST, vulnerability scanners, penetration tests, or bug bounty reports.
• Experience using tools such as Burp Suite, OWASP ZAP, or equivalent tools.
• Practical scripting ability in Python, Bash, or a similar language.
• Demonstrated ability to write clear runbooks and improve them using lessons from investigations.
• Strong analytical, critical-thinking, communication, and stakeholder-management skills.
• Ability to work independently on routine and moderately complex investigations.

Preferred qualifications

• Experience analysing WAF, CDN, API gateway, authentication, cloud, or application logs.
• Experience with Elastic, Splunk, Microsoft Sentinel, Chronicle, or an equivalent SIEM platform.
• Familiarity with CVSS, OWASP risk-rating methods, CWE, or similar frameworks.
• Exposure to bug bounty, threat hunting, digital forensics, or purple-team activities.
• Relevant certifications such as Security+, GCIH, GCIA, GWAPT, OSWA, or equivalent practical experience.

What success looks like

• Alerts and incidents are independently triaged and investigated within agreed targets.
• Findings and escalations contain clear evidence, context, and risk assessments.
• Vulnerabilities are accurately validated, prioritised, and tracked through closure.
• Runbooks and scripts reduce repetitive work and improve investigation consistency.
• Investigation lessons result in measurable improvements to procedures and alert quality.
• Less-experienced analysts receive useful guidance and review support.

Once on board we offer various programs and benefits:

• 22 annual vacation days, 3 sick days that are not carried to the next year (no medical certificate required)
• A seniority day is added every 3 years in the company
• Floating days - free day for every public holiday that falls on the weekend, with the exception of holidays which always fall during the weekend
• Annual Company Bonus prorated according to the number of worked months in a year
• Private medical insurance
• Access to an online benefit platform, with a monthly allowance of 690 RON, which you can choose to invest in different wellbeing, financial, or retail packages
• Financial support for the birth of your child or unhappy events
• A work culture based on cooperation and development - customized learning paths through external providers as well as special development programs.
• We offer remote work flexibility, driven by smart working principles and aligned with team goals and values
• Wellbeing initiatives to encourage a healthy work life balance through webinars, specialized sessions and internal programs, per our colleagues’ input