Senior Application Security Analyst

Who we are:

For over 25 years, Global Relay has set the standard in enterprise information archiving with industry-leading cloud archiving, surveillance, eDiscovery, and analytics solutions. We securely capture and preserve the communications data of the world’s most highly regulated firms, giving them greater visibility and control over their information and ensuring compliance with stringent regulations.

Though we offer competitive compensation and benefits and all the other perks one would expect from an established company, we are not your typical technology company. Global Relay is a career-building company. A place for big ideas. New challenges. Groundbreaking innovation. It’s a place where you can genuinely make an impact – and be recognized for it.

We believe great businesses thrive on diversity, inclusion, and the contributions of all employees. To that end, we recruit candidates from different backgrounds and foster a work environment that encourages employees to collaborate and learn from each other, completely free of barriers.

Job Purpose

The Senior Application Security Specialist is a senior technical role leading advanced application security testing, complex vulnerability analysis and threat modelling across the Application & Product Security function. You will provide technical leadership, mentor analysts and specialists, act as a security point of contact for engineering, and contribute to security strategy and standards.

Scope & Autonomy

Leads testing workstreams and sets the technical approach for complex assessments; acts as an escalation point for L1/L2 and a security partner to engineering.

Duties and Responsibilities

• Lead advanced security testing of critical applications and services, including deep-dive manual testing and targeted penetration tests across web, mobile and API surfaces.
• Own threat modelling using structured frameworks (STRIDE, PASTA), producing threat models for new features and architecture changes.
• Support and engage in the penetration testing programme.
• Design security test strategies for new products and major changes.
• Act as subject-matter expert and primary point of contact between engineering and the Application Security team.
• Provide oversight of scanning-tool usage and KPIs in the CI/CD pipeline.
• Own the overarching triage, escalation and evidence-quality framework across all scanning tools and testing streams, resolving the most complex or contested findings and setting the standard L1/L2 analysts and specialists are mentored against.
• Track and report key security testing metrics (e.g. time-to-remediate, recurring defect patterns) to senior stakeholders.
• Build and maintain advanced test cases, automation frameworks and custom tooling to improve coverage and efficiency.
• Own the security release process, including remediation verification and closure standards.
• Mentor and coach analysts and specialists; provide training material, playbooks and quality review of finding reports.
• Act as an escalation point for L1/L2 security analysts.
• Provide expert-level root-cause analysis and remediation guidance for the most complex or systemic security defects and set remediation standards developers and L1/L2 analysts follow across the programme.
• Develop and maintain process documentation and testing standards.