Senior Associate Product Application & AI Security

Role Summary:

The Product, Application & AI Security Senior Associate supports day-to-day Product Security, Application Security, and AI Security operations across the organization's application and technology portfolio. This hands-on role partners with Product, Engineering, DevOps, Architecture, and Security teams to perform security assessments, coordinate testing, manage vulnerability remediation, and support Secure SDLC activities.

Working under the direction of the Product & Application Security Senior Manager, the Senior Associate serves as an embedded security partner to engineering teams, helping identify, communicate, and remediate security risks throughout the software development lifecycle. The role is suited to a professional with strong technical application-security experience who enjoys practical execution, developer collaboration, and driving security outcomes across products and platforms.

Responsibilities:

1. Application & Product Security Operations

• Support security assessments for applications, APIs, SaaS platforms, cloud-native services, and AI-enabled solutions.
• Participate in threat-modeling workshops, architecture reviews, and application risk assessments.
• Review application designs, data flows, integrations, APIs, authentication models, and security controls.
• Identify security weaknesses and recommend practical remediation approaches.
• Support Security-by-Design initiatives throughout development and release lifecycles.
• Grant Thornton | Product, Application & AI Security

2. Security Testing Coordination & Execution

• Coordinate and track SAST, DAST, SCA, API security testing, penetration testing, and AI security assessments.
• Validate testing scope, onboarding requirements, and security coverage for new applications and products.
• Review scan results and assessment findings to identify valid security risks and false positives.
• Partner with engineering teams to prioritize findings based on severity and business impact.
• Assist with security retesting and verification activities before closure.

3. Vulnerability Management & Remediation

• Manage application and product-security findings throughout the remediation lifecycle.
• Track vulnerabilities from identification through closure and coordinate remediation with Product and Engineering teams.
• Support vulnerability triage, prioritization, risk rating, and ownership assignment.
• Monitor remediation SLAs and follow up on overdue findings.
• Assist with risk-acceptance and exception documentation when required.
• Prepare remediation status updates and tracking reports.

4. Secure SDLC & DevSecOps Support

• Support implementation of Secure SDLC requirements across development teams.
• Assist with onboarding and operation of security tools within CI/CD pipelines.
• Help engineering teams interpret security scan results and remediation guidance.
• Participate in release-readiness and security-gate activities.
• Promote secure coding practices and DevSecOps adoption.
• Contribute to security checklists, standards, playbooks, and developer-guidance materials

5. AI Security Support

• Support security assessments of AI-enabled applications, AI services, and agentic AI solutions.
• Review AI use cases, data flows, integrations, model interactions, and access-control designs.
• Document AI-specific security risks, findings, and recommended controls.
• Track remediation activities arising from AI security reviews.
• Assist with implementation of AI security governance requirements and controls.

6. Third-Party Product & SaaS Security

• Support security assessments of SaaS providers, technology vendors, APIs, and external platforms.
• Review assessment responses, supporting evidence, and security documentation.
• Identify security concerns and escalate material risks to the Product Security Manager.
• Track remediation commitments and follow-up actions with vendors and internal stakeholders.

7. Metrics, Reporting & Governance Support

• Maintain application-security dashboards and reporting metrics.
• Track security-testing coverage, vulnerability status, remediation effectiveness, and SLA performance.
• Support preparation of management reports and governance materials.
• Maintain evidence, documentation, and audit artifacts related to Product Security activities.
• Assist with continuous improvement of Product Security processes and procedures.

Education / Professional Experience / Skills:

• Hands-on application-security, product-security, security-engineering, vulnerability-management, or DevSecOps experience.
• Experience performing or coordinating SAST, DAST, SCA, penetration testing, vulnerability management, and secure-code reviews.
• Working knowledge of OWASP Top 10, OWASP ASVS, OWASP API Security Top 10, and Secure SDLC practices.
• Experience supporting remediation activities with software-engineering teams.
• Experience working with cloud-based applications and APIs.
• Familiarity with Azure DevOps, GitHub, GitLab, Jira, ServiceNow, or similar platforms.
• Strong analytical and problem-solving skills, with the ability to communicate technical findings clearly to developers and technical stakeholders.
• 5 to 8 years of experience in Application Security, Product Security, Security Engineering, Vulnerability Management, DevSecOps, or a related cybersecurity discipline.
• Bachelor's degree in Cybersecurity, Computer Science, Engineering, Information Technology, or a related field, or equivalent experience.