Cyber Security Analyst III - App Security & Vulnerability (Remote)

First Citizens Bank is seeking a highly skilled Cyber Security Analyst with a strong background in application security and vulnerability management. This role focuses on identifying, analyzing, and mitigating security risks across software development pipelines using SAST, DAST, and SCA tools.

Responsibilities:

• Perform static (SAST), dynamic (DAST), and software composition analysis (SCA) to identify vulnerabilities in applications and third-party components
• Analyze scan results, triage findings, and prioritize remediation efforts based on risk
• Partner with development teams to remediate vulnerabilities and improve secure coding practices
• Conduct regular security assessments and vulnerability scans across applications and environments
• Validate and reproduce vulnerabilities, including false positive elimination
• Track and report vulnerability metrics, risk trends, and remediation progress
• Configure, deploy, and maintain security scanning tools (e.g., Checkmarx, Veracode, Fortify, Snyk, Burp Suite, OWASP ZAP)
• Automate security testing processes using scripting or APIs
• Improve scanning efficiency and coverage through tuning and optimization

Requirements:

• Bachelor's Degree and 6 years of experience in Information Security OR High School Diploma or GED and 10 years of experience in Information Security
• Hands-on experience with: SAST, DAST, and SCA tools
• Web application security testing (OWASP Top 10, API security)
• Strong understanding of: Secure software development lifecycle (SDLC / DevSecOps)
• Common vulnerabilities (e.g., injection, XSS, authentication flaws)
• Proficiency in one or more programming/scripting languages (e.g., Python, Java, JavaScript, Bash)
• Experience interpreting and prioritizing scan results and remediation plans
• Experience integrating security tools into CI/CD pipelines (e.g., Jenkins, GitHub Actions, Azure DevOps)
• Familiarity of container and cloud security (AWS, Azure, GCP)
• Familiarity with AI/ML concepts and security implications
• Industry certifications such as: CEH, Security+, SSCP, GIAC or comparable