Overview
Application Security Analyst at Marriott Vacations Worldwide. This role focuses on incorporating security measures into the DevOps lifecycle and ensuring security is an integral part of software development and deployment processes.
Position Summary
As a member of the professional staff, contributes general knowledge and skill in a discipline area to support team and / or department objectives. Typically works under limited supervision within established guidelines, producing and analyzing complex business information to assist decision-making.
Specific Job Summary
The Application Security Analyst role is responsible for integrating security into the full DevOps lifecycle and enforcing secure coding standards in collaboration with development, operations, and security teams to embed vulnerability remediation within CI / CD pipelines. This role conducts security assessments (static and dynamic analyses, code reviews, automated vulnerability scans) across various applications and environments. It also includes hands-on offensive security testing and mapping attack scenarios to frameworks such as MITRE ATT&CK to assess defenses. The ideal candidate is a collaborative security professional with deep offensive security knowledge and a passion for improving security processes through continuous testing and learning.
Expected Contributions
- Contributes to team, department, and / or business results by performing complex qualitative and quantitative analysis for business processes and projects. Often manages small projects or parts of larger ones.
- Responds to, solves, and makes decisions on complex / non-routine business requests with limited to moderate risk.
- Assists more senior associates in achieving business results by identifying opportunities to enhance processes and participating in setting department operating plans.
- Achieves results against budget within scope of responsibility and demonstrates ongoing personal and professional development.
Specific Expected Contributions
Conducts thorough penetration testing of infrastructure, web applications, APIs, and cloud environments to identify vulnerabilities and attack vectors.Collaborates with development teams to implement security testing practices early in the SDLC, ensuring secure code and configurations.Reviews development processes to ensure secure coding practices are followed across development, staging, and production environments.Leads red team exercises to assess security resilience and collaborates with blue team members to improve detections and defenses.Maps offensive security test results to the MITRE ATT&CK framework and conducts vulnerability assessments and threat simulations.Documents findings with clear, actionable recommendations and mentors junior analysts on offensive security practices.Stays up to date with threats and vulnerability trends to continually improve testing practices.Candidate Profile
Successful candidates should possess knowledge, experience, and leadership skills as follows. A professional with knowledge in a discipline (e.g., Information Resources) and typically requires college degree and / or relevant experience.
Specific Candidate Profile
Education
Bachelor's degree in computer science, Information Security, or a related field. Equivalent work experience may be considered in lieu of a degree.Certifications Preferred
Offensive Security Certified Professional (OSCP)Certified Ethical Hacker (CEH)GIAC Penetration Tester (GPEN)Offensive Security Web Expert (OSWE)Certified Secure Software Lifecycle Professional (CSSLP)GIAC Web Application Penetration Tester (GWAPT)Experience
At least 4 years of experience in offensive security roles, including penetration testing, red teaming, and application security testing.Hands-on experience with penetration testing tools (e.g., Burp Suite, Metasploit, Kali Linux, Cobalt Strike) and scripting for security testing.Proven expertise in identifying and exploiting vulnerabilities in applications, including web, mobile, APIs, and cloud platforms.Experience with DevSecOps, CI / CD pipelines, and integrating security testing into the SDLC.Deep knowledge of application security testing methods (static, dynamic, fuzzing).Familiarity with SDL, secure code reviews, and application security code scanning.Experience with cloud platforms (AWS, Azure, GCP) and container security (Docker, Kubernetes).Ability to map attack scenarios to MITRE ATT&CK and provide insights for defense improvements.Skills / Attributes
Advanced penetration testing skills for web and mobile applications, APIs, and cloud services.Application security expertise, secure coding practices, and vulnerability scanning.Secure development knowledge and experience incorporating security into development processes and pipelines.Red team expertise with the ability to simulate sophisticated attacks and assess defenses.Cloud security knowledge for AWS / Azure and containerized apps (Docker, Kubernetes).Vulnerability management, exploitability assessment, and incident response collaboration.Strong documentation and reporting skills for technical and non-technical stakeholders.Mentorship and leadership to guide junior security team members and promote continuous improvement.Problem-solving and analytical thinking with attacker mindset for vulnerability discovery and mitigation.Marriott Vacations Worldwide is an equal opportunity employer committed to hiring a diverse workforce and sustaining an inclusive culture.
Seniority level
Mid-Senior levelEmployment type
Full-timeJob function
Information TechnologyIndustries
HospitalityReferrals increase your chances of interviewing at Marriott Vacations Worldwide by 2x
Sign in to set job alerts for "Application Security Analyst" roles.
J-18808-Ljbffr