Lead Application Security Specialist

About the role

Barclays is hiring a Lead Application Security Analyst in Whippany, NJ, to safeguard the bank's technology landscape. The role leads the evaluation, delivery and continuous improvement of Application Security and DevSecOps capabilities, turning multi-layered security-testing data into actionable risk insights and embedding proportionate controls across the software development lifecycle.

Key responsibilities

• Evaluate, deliver and continuously improve Application Security and DevSecOps capabilities, covering SAST, SCA, DAST, API security and AI-assisted security testing.
• Translate security-testing data into risk insights and partner with engineering, risk and governance stakeholders to improve control effectiveness and standards compliance.
• Develop and run assessments, audits and threat models to find vulnerabilities in systems, applications and servers, and report findings and remediation guidance to stakeholders.
• Work with stakeholders and IT teams to identify emerging attack techniques and support the development of penetration testing methodologies.
• Maintain reports on penetration test findings and collaborate with stakeholders on their security requirements and controls.
• Identify emerging vulnerabilities, exploit codes and attacks to develop testing methodologies and assurance activities.

Required profile

• Experience operating and evaluating SAST, SCA or DAST tools, including tuning policies, validating findings, reducing false positives and assessing exploitability.
• Experience applying secure coding and remediation practices in at least one ecosystem such as Java/Spring.NET, Go, Python or JavaScript/TypeScript.
• Ability to integrate application security testing into CI/CD pipelines, developer workflows and cloud-native environments (containers, Kubernetes, infrastructure as code).
• Ability to use data-analysis techniques and reporting tools to produce KRI/KCI dashboards and leadership insights.
• Ability to challenge engineering teams on detailed security risks and communicate technical findings to senior stakeholders.
• Valued: knowledge of cyber governance, security policies and control frameworks; software supply chain security, secrets scanning, SBOMs and vulnerability management; exposure to AI-assisted security testing.

What we offer

• Base salary of $175,000 to $225,000.
• Eligibility for an incentive award.
• Employee benefits including medical, dental and vision coverage, 401(k), life insurance and paid leave.