Stafford Gray

IT Security Auditor

Lansing, Michigan, United StatesHybridContract

Salary not posted. The employer did not include pay in this listing. Ask for the range in your first conversation; it is a fair question.

Posted 4 days ago · listed on Workable

Apply on Workable →Tailor my resume to this job, free

Should you apply?

Company website ↗

Open: 4 days; Fresh. First-week applicants get read first.
Open roles at this company: 4; A few open seats. Your application will get a real look.
Salary: Not posted; No range in the posting. Ask early. It is a fair question and it saves everyone time.

Days open comes from the posting date. Fill time and reposting rate come from this company's recent public postings.

The job, broken down

This role embeds a security specialist inside software development teams to catch vulnerabilities before code ships, using SAST, DAST, and SCA tools. It's hands-on secure coding and DevSecOps work, not SOC monitoring or incident response.

What you'd actually do

Run static, dynamic, and software composition analysis scans on applications
Work directly with front-end, back-end, and cloud developers on secure coding fixes
Inspect HTTP request/response headers and API traffic for security issues
Explain and help remediate OWASP Top 10 vulnerabilities in code
Help build and automate secure configuration, verification, and compliance checks (DevSecOps)
Review authentication flows involving JWT, OAuth/OIDC/PKCE

Must-haves

5+ years total IT experience
3+ years applying secure coding standards (OWASP Top 10, SANS, CWE Top 25, CSA, SafeCode, etc.)
3+ years working with languages/frameworks like Angular, React, Node.js, Java, Spring Boot, WebSphere, JBoss, or .NET
3+ years in networking, infrastructure, and security automation (DevSecOps)
3+ years building and deploying secure, complex distributed web/mobile applications
Experience with AppSec scanning tools: SAST, DAST, SCA, ASOC, container/cloud scanning
Must live within 90-100 miles of Dimondale, MI at time of application
Must be able to pass a CJIS background check

Nice to have

Experience with Coverity, BlackDuck, SRM, or Fortify
High-level understanding of containers
Cloud development experience with Azure, AWS, or GCP

Read before you apply

Hard local-residency requirement (90-100 miles of Dimondale, MI) will screen out remote applicants regardless of skill
CJIS background check requirement means the hiring process will take longer and may disqualify people with certain records

Written from the posting text only. Check the full description below before you decide.

Career Pulse

See how you stack up for this job.

It's not just about searching for jobs. We help you land it. Upload your resume once. Career Pulse scores you against this exact posting, shows where you match and where you fall short, then rewrites your resume for it. Free.

Steps to get this job

1Confirm and state your distance from Dimondale, MI directly in your resume or cover letter since this is a hard filter
2Lead with specific SAST/DAST/SCA tool names you've used (Coverity, BlackDuck, Fortify, or others) since these are named directly in the posting
3Give one concrete example where you found or fixed an OWASP Top 10 vulnerability (XSS, injection, SSRF, CSRF) in a real codebase
4Mention any hands-on work with JWT, OAuth/OIDC/PKCE or API replay attack testing, since these are called out specifically as functional knowledge

Check my fit for this job, free →

Coming to Premium: Job Intel. The hiring contact behind this posting, their LinkedIn, a verified work email when we have one, and the note to send.

What it's like to work at Stafford Gray

Premium

The full picture: what employees say in public reviews, with sources
Recent news and signals about how the company is doing
How to position yourself when you apply here

Create a free account to unlock

About the role

Senior Full Stack Application Development Security Auditor who is passionate about designing and building secure platforms and applications through Dynamic, Static, and Software Composition Analysis assessments. This position is not a member of the Security Operations Center — rather, it is dedicated to working with software development teams on secure coding practices. The ideal candidate will feel comfortable working with front-end, back-end, and cloud-based application developers.

Partnering with distributed teams, this role helps transform the way systems are built, secured, authorized, and operated for continuous compliance and risk mitigation. The candidate will help lead efforts to implement security patterns and practices with orchestration and automation tools that automate secure configuration, verification, compliance, and authorization of systems and their development — serving as a key contributor to maturing the organization's secure software development practices.

Functional Knowledge:

Chrome/Firefox/Edge developer tools for inspecting request/response headers
Experience with Application Security scanning tools (SAST, DAST, SCA, ASOC, Container/Cloud) — required
Experience with Coverity, BlackDuck, SRM, or Fortify — a plus
HTTP request/response headers for web and RESTful API calls
Ability to explain in detail any of the OWASP Top 10 vulnerabilities (Cross-Site Scripting, Injection attacks, SSRF, CSRF, XML entity, etc.)
API security, JWT, OAuth/OIDC/PKCE
Web and API replay attacks
High-level understanding of containers
Cloud development experience (Azure, AWS, GCP)

Requirements

Minimum Qualifications:

5+ years of total IT-related experience
3+ years implementing/utilizing Federal, Industry, and Open-Source Security Guidance and Secure Coding Practices (OWASP Top 10, SANS, CERT, CWE Top 25, Critical Security Controls, Cloud Security Alliance, SafeCode, etc.)
3+ years with compiled and interpreted languages such as Angular, React, Node.js, Java, Spring Boot, IBM WebSphere, Oracle JBoss, or .NET stacks
3+ years with networking, infrastructure, secure application development, and security automation (DevSecOps)
3+ years of hands-on experience building and deploying secure, complex distributed web and mobile applications
Must be located within 90–100 miles of Dimondale, MI at time of submission (local candidates only — hard requirement)
Must be able to pass a CJIS background check

Apply on Workable →or tailor my resume first, free