Senior Application Security Analyst - L3
Global Relay1 month ago
Responsibilities
- Lead advanced manual security testing and targeted penetration tests across web, mobile, and API surfaces.
- Own threat modeling for new features and architecture changes using structured frameworks.
- Design security test strategies for new products and major changes.
- Serve as the primary application security point of contact and escalation partner for engineering and L1/L2 analysts.
- Oversee scanning-tool usage, security testing KPIs, triage, escalation, evidence quality, and remediation verification.
- Build advanced test cases, automation frameworks, and custom tooling to improve testing coverage and efficiency.
- Track and report metrics such as time-to-remediate and recurring defect patterns to senior stakeholders.
- Mentor and coach analysts and specialists and develop training materials, playbooks, documentation, and testing standards.
- Provide root-cause analysis and remediation guidance for complex or systemic security defects.
Requirements
- 5–8 years of hands-on experience in application security testing.
- Advanced knowledge of internet, network, web, API, mobile, container orchestration, Kubernetes, and AI/LLM security.
- Expert understanding of common vulnerabilities and security controls, including OWASP Top 10, API/LLM Top 10, and Mobile Top 10.
- Advanced Android and iOS security testing experience, including reverse engineering, runtime manipulation, Frida scripting, and Objection.
- Strong offensive security skills in manual web and API testing, authentication and authorization bypass, session management, business-logic abuse, and data-protection testing.
- Experience with Kubernetes security, including cluster hardening, RBAC, and workload isolation.
- Ability to build security automation using Python and Bash and integrate testing with TestRail, Jira, Burp Suite Pro, Postman, and SonarQube.
- Knowledge of threat actor tactics, advanced persistent threats, MITRE ATT&CK, emerging vulnerability classes, and programming-language-specific remediation techniques.
- Excellent communication skills and the ability to influence technical and non-technical stakeholders.
- OSCP or OSWE certification is preferred.
- Candidates must have the right to work in the UK; visa sponsorship is unavailable.
Benefits
- Mentoring, coaching, and support for career development.
- Collaborative, diverse, inclusive, and equal-opportunity workplace.
- Reasonable adjustments, accommodations, and personal time tailored to individual needs.
Tech Stack
Categories
About Global Relay
Global Relay is a leading provider of end-to-end recordkeeping solutions for the global financial sector and other highly regulated industries. Founded in 1999, Global Relay delivers a complete suite of compliant communications solutions, spanning a unified, intelligent archive, powerful data connectors, AI-enabled surveillance, and our own Global Relay App. Global Relay’s integrated recordkeeping solutions enable regulated organizations to meet collaboration, privacy, and security requirements.