Application Security Analyst I

• Support and administer application security tools including SAST, SCA, DAST, API security, secrets scanning, container scanning, and Infrastructure-as-Code (IaC) security solutions.
• Validate security findings, assess potential impact, prioritize vulnerabilities, and support remediation efforts through verified closure.
• Perform targeted security testing of web applications, APIs, authentication and authorization controls, file handling functions, business logic, and data flows.
• Execute application security testing activities required through Secure SDLC and AI Development Lifecycle (AIDLC) processes while maintaining supporting evidence and documentation.
• Provide developers with remediation guidance based on scanning results, security testing findings, code reviews, and security incidents.
• Support monitoring of software supply chain risks including third-party dependencies, repositories, CI/CD credentials, artifact integrity, and software bills of materials (SBOMs).
• Assist in maintaining the application catalog by onboarding applications, validating ownership information, and ensuring inventory records remain accurate.
• Maintain application security profiles including data sensitivity, security-tool coverage, testing records, findings, and risk information.
• Help validate that required security scans, reviews, and testing activities are completed before software releases.
• Support security reviews of AI-generated code and AI-enabled applications, including testing for prompt injection, data leakage, insecure outputs, authorization weaknesses, and improper use of sensitive information.
• Produce security metrics, testing evidence, remediation reports, and compliance-related documentation.
• Escalate complex technical risks, architectural concerns, and design-related security issues to senior application security team members when required.

• Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Technology, Software Engineering, or a related field, or equivalent experience.

•

Security Engineering, DevSecOps, Software Development, Penetration Testing, or a related cybersecurity discipline.

• Hands-on experience with SAST, SCA, DAST, API security testing, container security, vulnerability management, or similar application security technologies.
• Familiarity with application security tools such as Veracode, Wiz, Sysdig, Burp Suite, Postman, or equivalent platforms.
• Working knowledge of web security, API security, authentication, authorization, secure coding, cryptography, and software supply chain security.
• Experience supporting Secure SDLC, CI/CD pipelines, Git workflows, security testing, and release security controls.
• Knowledge of OWASP Top 10, OWASP API Security Top 10, MITRE CWE, NIST SSDF, HIPAA, HITRUST, SOC 2, and related security frameworks.
• Strong analytical, communication, documentation, and reporting skills.
• Fluent in written and verbal English.

• Exposure to security tools such as Veracode, Wiz, Sysdig, Burp Suite, Postman, or similar application security platforms.
• Experience with healthcare SaaS platforms, PHI processing environments, cloud-native applications, containers, or multi-tenant platforms.
• Working knowledge of Python, Java, JavaScript/TypeScript, or C# from a development, automation, or code review perspective.
• Security certifications such as CompTIA Security+, CSSLP, AWS Certification, GWAPT, GWEB, or equivalent application security credentials.

IQVIA is a leading global provider of clinical research services, commercial insights and healthcare intelligence to the life sciences and healthcare industries. We create intelligent connections to accelerate the development and commercialization of innovative medical treatments to help improve patient outcomes and population health worldwide. Learn more at https://jobs.iqvia.com

IQVIA is committed to integrity in our hiring process and maintains a zero tolerance policy for candidate fraud. All information and credentials submitted in your application must be truthful and complete. Any false statements, misrepresentations, or material omissions during the recruitment process will result in immediate disqualification of your application, or termination of employment if discovered later, in accordance with applicable law. We appreciate your honesty and professionalism.