Senior Application Security Analyst
Health Benefits Exchange · Thurston County – Olympia, WA · Washington
- Role
- Software engineer
- First seen
- Jun 12, 2026
- Closes
- Not listed
- Salary
- Permanent - $113,668.00 - $148,263.00 Annually
Apply on the Washington portal
Applications go through the state’s official system — CivicWorks only tracks the posting.
Summary
The Senior Application Security Analyst protects the Washington Health Benefit Exchange's data and applications by integrating security controls throughout the software development lifecycle across cloud and on-premises environments. Operating under the Application Security Lead, this senior technical role collaborates with delivery teams, DevOps, architects, and IT to implement secure software development practices, conduct security assessments, and drive continuous improvement of application security posture. Key responsibilities include vulnerability management, threat modeling, code reviews, penetration testing, and providing guidance to development teams on remediation and secure coding standards.
Key qualifications
- Seven years of information security experience in specialized roles such as security architecture, penetration testing, or application security
- Demonstrated knowledge of secure SDLC, secure architecture design, and cloud architecture including DevSecOps practices
- Experience performing application security code reviews and risk assessments using automated and manual techniques
- Experience with common vulnerability assessment tools such as Nessus, Rapid7, Burp Suite, SAST, DAST, and SCA tools
- Strong analytical and problem-solving skills with experience integrating security in CI/CD pipelines and infrastructure-as-code
- Demonstrated strong interpersonal and collaboration skills working with cross-functional teams and external partners
Summarized by CivicWorks from the state’s posting — check the official listing for full details.
Tracked by CivicWorks from Washington’s public career portal. Posting data refreshes daily; this page disappears when the posting closes.