Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 2 days ago

Application Security Consultant - DAST

MassMutual76 open roles

Pay
$137,800 – $180,800 a year
Where
Springfield MA
Work mode
Hybrid
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowApplication Security Consultant - DASTMassMutual · Springfield MA

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on MassMutual's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

10.7% of postings close within 7 days. Measured by our own scanner across the market. MassMutual postings stay open a median of 9 days.

Share of postings closed within
  1. 2.0%1 day
  2. 4.4%3 days
  3. 10.7%7 days
  4. 16.1%14 days
  5. 34.1%30 days
This job: posted 2 days ago

MassMutual median: 9 days open

The posting

Application Security Consultant - DAST

Enterprise Cyber Security

Full Time, Springfield - MA

The Opportunity

We are seeking a highly skilled and experienced Application Security Consultant to advance our application security initiatives, with a particular emphasis on dynamic application security testing (DAST). You will own and mature how we test running applications and APIs for exploitable weaknesses, drive secure development practices, and implement solutions that protect our systems and data from evolving threats. The role partners with development teams, security architects, leadership, and other stakeholders to embed security into every stage of the software development lifecycle.

The Team

Our Application Security team keeps MassMutual's software applications secure through rigorous assessment and proactive development team engagements. We work closely with security architects, DevOps engineers, and software developers, while our core focus is identifying and verifying vulnerabilities — including hands-on dynamic testing of running applications and APIs — implementing security best practices, and helping development teams remediate. Our backgrounds span software engineering to red teaming, and we value continuous learning, innovation, and collaboration.

The Impact

Your key responsibilities will ensure applications are resilient against emerging threats, reducing the financial and reputational damage of security incidents.

  • Own and advance our dynamic application security testing (DAST) program — selecting, deploying, configuring, and maintaining DAST tooling across our web application and API estate.
  • Design and run authenticated dynamic scans against complex applications, including session handling, multi-step workflows, single-page applications, and REST/GraphQL APIs.
  • Integrate DAST into CI/CD pipelines and pre-production environments so dynamic testing runs continuously rather than as a point-in-time exercise, and define the thresholds that gate a release.
  • Triage, validate, and tune DAST output — eliminating false positives, confirming exploitability through manual verification, and translating findings into actionable remediation guidance for development teams.
  • Complement automated dynamic testing with manual techniques to identify, risk-assess, and prioritize application-level vulnerabilities (e.g., OWASP Top 10) that scanners alone do not surface.
  • Conduct in-depth security assessments, including vulnerability scanning and code review.
  • Conduct detailed threat modeling to identify attack vectors and potential weaknesses, and use the results to focus dynamic test coverage where risk is highest.
  • Collaborate with security architects to design secure application architectures aligned to industry best practices, ensuring secure coding practices are followed and security controls are built into software designs.
  • Partner with our SDLC Council to develop and maintain secure coding standards that empower developers to integrate security into their own workflow.
  • Partner with DevOps teams to implement security controls within CI/CD pipelines for automated, seamless deployment of secure code.
  • Maintain the broader application security testing toolchain, including static analysis (SAST) and software composition analysis (SCA), alongside DAST.
  • Evaluate third-party software and APIs for security compliance, including dynamic testing of externally sourced components where appropriate.
  • Support incident response for application security events, providing rapid identification and mitigation guidance.
  • Ensure compliance with applicable security regulations, frameworks, and industry standards.
  • Use reporting tools to communicate vulnerability and code-defect risk to MassMutual's cyber assets through metrics (KPIs, KRIs, OKRs), enabling team leaders and executive leadership to make risk-based prioritization decisions.
  • Educate developers and stakeholders on secure coding practices and on interpreting and acting on dynamic test results.
  • Stay current on security threats, vulnerabilities, and industry trends, and apply them to improve our security strategy.

The Minimum Qualifications

  • Bachelor's Degree
  • 8+ years of experience in application security, penetration testing, or secure software development.

The Ideal Qualifications

  • Deep, hands-on expertise with DAST tooling (e.g., Burp Suite, OWASP ZAP, Invicti, Acunetix, StackHawk) including authenticated scan configuration, scan policy tuning, and API scanning.
  • Demonstrated hands-on experience with dynamic application security testing (DAST) of web applications and APIs.
  • Experience operationalizing DAST at scale — pipeline integration, scheduled scanning across a large application estate, results triage workflows, and reducing false-positive rates over time.
  • Relevant security certifications such as CEH, OSCP, CISSP, or GWAPT from an industry-recognized certifier (e.g., SANS/GIAC, CompTIA, ISACA, ISC2).
  • Strong knowledge of secure software development methodologies, including threat modeling, code review, and static/dynamic analysis.
  • Deep understanding of common application vulnerabilities (e.g., OWASP Top 10) and their mitigations, with the ability to manually verify and exploit findings to confirm real risk.
  • Experience integrating security into DevOps (DevSecOps) and CI/CD environments.
  • Strong technical knowledge of web application security, cloud security (AWS, Azure, GCP), mobile security, infrastructure as code, containerized environments (Docker, Kubernetes), and API security.
  • Hands-on experience across the wider testing toolchain — SAST, SCA, IAST, and fuzzing tools.
  • Experience identifying security defects in container images and Kubernetes environments.
  • Advanced proficiency writing source code in at least one programming language (e.g., Java, JavaScript, C/C++/C#, Python) and familiarity with common build and dependency tooling (e.g., Maven, Gradle, Node).
  • Experience with cloud deployment and automation tooling (Terraform, GitHub Actions, Jenkins, AWS CloudFormation, secrets managers).
  • Working knowledge of encryption, authentication, and access control.
  • Knowledge of compliance and regulatory frameworks (e.g., SOC 2).
  • Strong analytical and problem-solving ability, with excellent communication skills — able to explain security issues to both technical and non-technical stakeholders.
  • A collaborative team player comfortable in a fast-paced environment.

#LI-RK1

Salary Range:

$137,800-$180,800

At MassMutual, we focus on ensuring fair equitable pay, by providing competitive salaries, along with incentive and bonus opportunities for all employees. Your total compensation package includes either a bonus target or in a sales-focused role a Variable Incentive Compensation component.

Why Join Us.

We’ve been around since 1851. During our history, we’ve learned a few things about making sure our customers are our top priority. In order to meet and exceed their expectations, we must have the best people providing the best thinking, products and services. To accomplish this, we celebrate an inclusive, vibrant and diverse culture that encourages growth, openness and opportunities for everyone. A career with MassMutual means you will be part of a strong, stable and ethical business with industry leading pay and benefits. And your voice will always be heard.

We help people secure their future and protect the ones they love. As a company owned by our policyowners, we are defined by mutuality and our vision to put customers first. It’s more than our company structure – it’s our way of life. We are a company of people protecting people. Our company exists because people are willing to share risk and resources, and rely on each other when it counts. At MassMutual, we Live Mutual.

MassMutual is an equal employment opportunity employer. We welcome all persons to apply.

If you need an accommodation to complete the application process, please contact us and share the specifics of the assistance you need.

At MassMutual, we focus on ensuring fair, equitable pay by providing competitive salaries, along with incentive and bonus opportunities for all employees. Your total compensation package includes either a bonus target or in a sales-focused role a Variable Incentive Compensation component. For more information about our extensive benefits offerings please check out our Total Rewards at a Glance.

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against MassMutual's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on MassMutual's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    MassMutual's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.