Application Security Consultant
Location: New York, NY
Work Arrangement: 100% Onsite
Duration: 12 Months Work
Schedule: 37.5 Hours per Week
Position Overview
The Application Security Consultant will provide specialized security expertise to application development teams, product owners, infrastructure teams, and cybersecurity leadership. This role focuses on strengthening application security throughout the Software Development Life Cycle (SDLC) and DevOps processes through security assessments, secure architecture reviews, security tooling optimization, and operational governance.
The consultant will also be responsible for onboarding, configuring, tuning, and monitoring security protections across Akamai and Cloudflare Web Application Firewall (WAF) platforms, ensuring consistent protection for high-value, cloud-hosted, and externally facing applications.
The ideal candidate will have extensive hands-on experience with Akamai WAF, Cloudflare WAF, application security testing, and modern cloud architectures, along with the ability to coach development teams and establish repeatable security processes.
Key Responsibilities
Conduct application security assessments and technical reviews throughout the SDLC.
Perform secure architecture reviews and recommend security improvements for applications and infrastructure.
Configure, manage, tune, and monitor Cloudflare and Akamai WAF platforms.
Develop and maintain WAF policies, rulesets, firewall rules, bot-management controls, DNS configurations, and DDoS protections.
Manage Akamai security configurations using Kona Site Defender (KSD) and Property Manager.
Perform WAF policy staging, testing, validation, and deployment to minimize false positives and maintain application availability.
Analyze HTTP traffic, request headers, payloads, and attack patterns to identify application vulnerabilities.
Assess and mitigate common application security risks, including Cross-Site Scripting (XSS), SQL Injection (SQLi), Remote Code Execution (RCE), deserialization attacks, Cross-Site Request Forgery (CSRF), and Server-Side Request Forgery (SSRF).
Implement and optimize Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) tools.
Integrate security tooling and telemetry from WAF platforms, vulnerability scanners, SIEM/SOAR solutions, and cloud logging services.
Develop security dashboards, metrics, and reports to monitor application security posture and operational effectiveness.
Collaborate with application development and DevOps teams to integrate security controls into development and deployment pipelines.
Provide technical guidance, coaching, and recommendations to development teams on secure coding and application security best practices.
Establish repeatable security processes, operational procedures, governance standards, and performance metrics.
Support security monitoring, vulnerability remediation, and continuous improvement of application security controls.
Required Technical Skills & Experience
Cloudflare WAF: Minimum 5 years of hands-on experience with policies, rulesets, firewall rules, bot management, DNS, DDoS protection, and Logpush.
Akamai WAF: Minimum 4 years of hands-on experience with Kona Site Defender (KSD), Property Manager, Bot Manager, Edge DNS, and log staging/testing.
Application Security: Deep understanding of the OWASP Top 10, application security principles, and secure development practices.
Security Testing Tools: Minimum 5 years of experience with SAST, DAST, and SCA tools such as Checkmarx, Burp Suite, Fortify, or equivalent platforms.
Web Traffic Analysis: Experience analyzing HTTP traffic, headers, payloads, and application attack vectors.
Vulnerability Assessment: Knowledge of XSS, SQLi, RCE, deserialization, CSRF, SSRF, and other common application security vulnerabilities.
Cloud Technologies: Experience with Azure, AWS, SaaS platforms, and modern application architectures.
Security Telemetry & Monitoring: Experience integrating or consuming security data from WAFs, scanners, SIEM/SOAR platforms, and cloud logs.
Reporting & Metrics: Ability to build dashboards, analyze security metrics, and communicate findings to technical and business stakeholders.
