Senior Application Security Analyst

Our mission is to help people integrate technology into everyday life and to enable innovation through technology. We offer software development and infrastructure solutions, with advanced competences in Blockchain, Artificial Intelligence and Machine Learning. All our offices (in Western Europe or nearshore, in CEE) are located within the boundaries of the European Union. We believe working in close cooperation with our clients and employees is the key to success; this means we offer people the best working environment in order to achieve the best results. We love entrepreneurial spirits and encourage people around us to be proactive and make the best decisions not only for business, but for their own personal development. Our nearshore Romanian offices are in Bucharest (Victoriei Square) and Iasi (Palace) and, with over 9000 team members at group level, we make sure we are always close to our customers.

Role Overview:

We are looking for a Senior Application Security Analyst to lead complex application-security

investigations and improve the services, processes, and practices used to manage application

risk.

You will handle high-complexity incidents and vulnerability cases, guide other analysts,

coordinate investigations across multiple stakeholders, and drive improvements to runbooks,

telemetry, alert quality, and operational performance.

Key Responsibilities:

Complex investigations and incident leadership:

• Lead high-complexity investigations involving applications, APIs, authentication systems,

and internet-facing services.

• Form and test investigation hypotheses by correlating telemetry across multiple systems

and data sources.

• Establish incident scope, timeline, root cause, attack path, affected assets, and potential

business impact.

• Coordinate evidence gathering, analysis, handovers, and specialist contributions during

significant incidents.

• Recommend containment and risk-reduction actions and provide clear technical context

for decision-makers.

• Review investigation quality, risk assessments, and closure decisions for significant

cases.

• Participate in or lead incident-response duties where required.

Advanced vulnerability analysis:

• Lead the validation and prioritisation of complex or high-impact findings from security testing, bug bounty, incident response, and external disclosures.
• Assess exploitability, attack chains, exposure, asset criticality, affected data, and compensating controls.
• Identify patterns across incidents and vulnerabilities and recommend measures that address recurring root causes.
• Resolve ambiguous or disputed findings by presenting clear evidence and risk-based reasoning.
• Guide stakeholders through difficult prioritisation, escalation, and risk-acceptance decisions.
• Service and process improvement
• Own and improve investigation procedures, runbooks, escalation paths, quality standards, and case-review practices.
• Identify gaps in telemetry and investigation capability and define clear requirements for the teams responsible for addressing them.
• Drive improvements to alert fidelity, investigation efficiency, reporting quality, and operational coverage.
• Develop advanced scripts, queries, and analytical methods for complex investigations and recurring use cases.
• Lead tabletop exercises, case reviews, and post-incident improvement activities.
• Use operational metrics and investigation outcomes to prioritise service improvements.

Technical leadership and collaboration:

• Act as a senior subject-matter expert for application-security investigations and vulnerability analysis.
• Mentor analysts and improve team capability through coaching, peer review, and knowledge sharing.
• Communicate complex technical findings and uncertainty clearly to technical and non-technical stakeholders.
• Coordinate work across application owners, incident responders, security specialists, and leadership.
• Represent the application-security analysis function in complex cross-team discussions

Requirements:

• 5–8 years of relevant experience in application security, incident response, security operations, vulnerability research, penetration testing, or a related cybersecurity role.
• Extensive experience leading complex security investigations using SIEM and other telemetry platforms.
• Advanced ability to correlate data across multiple sources, reconstruct attack timelines, and determine root cause and business impact.
• Deep understanding of web application and API security, common attack techniques, and defensive controls.
• Strong experience validating complex vulnerabilities, attack chains, and evidence of exploitation.
• Advanced proficiency with web-security and investigation tools such as Burp Suite, OWASP ZAP, Elastic, Splunk, or equivalent platforms.
• Strong scripting capability in Python, Bash, or a similar language for investigation and operational automation.
• Demonstrated experience creating and improving runbooks, analytical methods, and incident-response processes.
• Strong critical-thinking skills and the ability to make risk-based decisions with incomplete or ambiguous information.
• Demonstrated ability to lead investigations, mentor analysts, and influence stakeholders across organisational boundaries.
• Excellent written and verbal communication skills.

Preferred qualifications

• Experience with large-scale WAF, CDN, API gateway, authentication, cloud, or application telemetry.
• Experience with threat hunting, digital forensics, incident command, or purple-team activities.
• Experience developing investigation metrics, quality controls, or operational service reviews.
• Familiarity with CVSS, OWASP risk-rating methods, CWE, MITRE ATT&CK, or equivalent frameworks.
• Relevant certifications such as GCIH, GCIA, GWAPT, GXPN, OSCP, OSWE, or equivalent practical experience.

What success looks like

• Complex incidents and vulnerabilities are handled with clear technical leadership and sound risk decisions.
• Investigations produce defensible conclusions on scope, impact, root cause, and required action.
• Analysts receive effective technical guidance and improve their independence over time.
• Runbooks, analytical methods, and quality standards improve based on operational evidence.
• Alert quality and investigation efficiency show measurable improvement.
• Senior stakeholders receive clear, timely, and decision-ready security analysis

Once on board we offer various programs and benefits:

• 22 annual vacation days, 3 sick days that are not carried to the next year (no medical certificate required)
• A seniority day is added every 3 years in the company
• Floating days - free day for every public holiday that falls on the weekend, with the exception of holidays which always fall during the weekend
• Annual Company Bonus prorated according to the number of worked months in a year
• Private medical insurance
• Access to an online benefit platform, with a monthly allowance of 690 RON, which you can choose to invest in different wellbeing, financial, or retail packages
• Financial support for the birth of your child or unhappy events
• A work culture based on cooperation and development - customized learning paths through external providers as well as special development programs.
• We offer remote work flexibility, driven by smart working principles and aligned with team goals and values
• Wellbeing initiatives to encourage a healthy work life balance through webinars, specialized sessions and internal programs, per our colleagues’ input