Application Security Engineer North Dallas or Detroit Metro locations

Req Number: 237665

We invite you to explore the award-winning culture, people, rewards and opportunities that make Comerica Bank so special. Make your next career choice a confident one.

Position Qualifications:

• Bachelor’s degree from an accredited university in Computer Science, Mathematics, Information Technology, Big Data, Cyber Security or equivalent through a combination of education and/or technology experience or 12 years of technology experience
• 8 years progressive cyber security technology experience
• 5 years of experience in application security engineering
• 2 years of Static Application Security Testing (SAST) Snyk experience preferred
• 2 years of Dynamic Application Security Testing (DAST) Rapid7 experience preferred
• 2 years web application development/object-oriented programming
• 2 years working with attack vectors in OWASP top 10
• 1 year of threat modeling

Application Security Engineer

The Application Security Engineer provides a higher level of security in Comerica's web application environments. Generally working with dynamic and static code analyzers, communicates vulnerabilities to development teams and coaches as necessary to remediate these vulnerabilities. Integrates tool output into development pipelines. Creates and shares proof of concept code to demonstrate application attacks. Onboards applications and vulnerability tracking into management system and reports on progress. Hosts threat modeling exercises based on STRIDE or other industry standard methodology to draw out vulnerabilities during design phase. Guides aspiring application security individuals, leads implementation of new tools and methods. Significant overlap and interplay with Penetration Testing team.

Position Responsibilities:

Static and Dynamic Code Analysis

• Performs integration of static and dynamic code scan output into CI/CD pipeline.
• Reviews of code analysis output and translation into findings.
• Utilizes the finding management software and tracking remediations with the development teams.
• Performs development and application team education resolution training.
• Performs emerging threat and threat landscape research.
• Provides forensic cyber event analysis.
• Identifies means to reduce cyber-attack effectiveness.
• Looks for continuous improvement of detections for operationalization.

Threat Modeling and Emerging Vulnerability Detection

• Leads threat modeling workshops to draw out vulnerabilities.
• Champions industry standard Threat Modeling framework (such as STRIDE).
• Updates detection tools as new vulnerabilities emerge.
• Stays aware of new vulnerabilities to articulate their inner workings against Comerica's environment.

Company Expert Application Security Consulting

• Works closely with partners in Cyber and Technology to solve security problems.
• Serves as the escalation point for cyber incidents, events, and application vulnerability research.
• Identifies and provides guidance to mitigate threat vectors unique to the shared cyber-attack surface.
• Proactively communicates with application development teams to illustrate vulnerabilities and solutions.

Planning and Organizing

• Identifies & evaluates projects, products, and solutions to enhance threat detection and other capabilities.
• Provides expert guidance on highly complex, large projects to incorporate cyber and fraud detection capabilities and considerations.
• Participates in industry working and information sharing groups.

Administration

• Keeps management informed of status of threats, the threat landscape, and current incidents and events through appropriate reporting.
• Actively participates on committees representing Cybersecurity.
• Keeps abreast of leading-edge technologies in the application security space.
• Other duties as assigned.

8:00am - 5:00pm Monday - Friday

Category C - Days may vary based on workweek schedule (1-5 days in office)

Plano

We know that our employees are critical to our overall success. We are dedicated to investing in their future to maintain long-term relationships for lasting commitments. One of the ways we do this is to offer a comprehensive package of compensation and benefits programs which are regularly reviewed to maintain them at competitive levels. Your salary will be commensurate with your work experience.

Upon offer, Comerica conducts a comprehensive background and fingerprint check.

NMLS certification requirement: where applicable, a favorable background check screening, credit check, fingerprint check, and NMLS certification is required in accordance with the SAFE Act.

Comerica Incorporated (NYSE: CMA) is a financial services company headquartered in Dallas, Texas, and strategically aligned by the Business Bank, the Retail Bank, and Wealth Management. Comerica's more than 9,000 colleagues focus on relationships, and helping people and businesses be successful. In addition to Texas, Comerica Bank locations can be found in Arizona, California, Florida and Michigan, with select businesses operating in several other states, as well as in Canada and Mexico.

Comerica is proud to be an Equal Opportunity Employer - veterans/individuals with disabilities, committed to workplace diversity.