Information Security Analyst (App Security)

Company Description
For over 100 years, BlueScope continues to build on our reputation of quality brands and products, leading technology and a customer-first spirit. Through our global brands, we are one of the largest manufacturers of building solutions in the world. Our diverse, bright and inspired workforce is committed to bettering the communities we serve through breakthrough thinking and innovations. Your goals, ideas and perspective can help shape our future – we look forward to hearing them!   

Cybersecurity Operations

• Support cybersecurity operations across BlueScope North America.
• Participate in security monitoring, investigation, and incident response activities under the direction of senior security team members.
• Participate in security monitoring, investigation, and incident response activities under the direction of senior security team members
• Maintain operational documentation, procedures, metrics, and status reporting for cybersecurity activities.
• Monitor relevant security threats and vulnerabilities and escalate issues that may affect BlueScope operations.

Application Security

• Support application security activities for BlueScope applications and development teams globally while operating primarily during U.S. business hours.
• Assist with security reviews for internally developed, externally developed, and third-party applications.
• Use application security testing capabilities such as static application security testing (SAST), dynamic application security testing (DAST), software composition analysis (SCA), API testing, and dependency scanning.
• Partner with development and technology teams to promote secure coding, security-by-design, and secure Software Development Lifecycle (SDLC) practices.
• Assist with application threat modeling, security requirements, and design reviews for new applications and significant changes.
• Document application security findings, provide practical remediation guidance, and track findings through closure.
• Validate corrective actions and help identify recurring issues that can be addressed through standards, training, or automation.

Security Tools & Process Improvement

• Assist with the administration, configuration, and improvement of cybersecurity and application security tools.
• Support the integration of security testing into development and CI/CD workflows in partnership with development and platform teams.
• Use scripting or automation to improve repeatable security tasks, data collection, reporting, and workflow efficiency.
• Develop and maintain dashboards and metrics that communicate security findings, remediation progress, and program performance.

Governance, Compliance & Assurance

• Support security activities aligned with applicable BlueScope requirements and recognized frameworks such as NIST Cybersecurity Framework, CIS Controls, ISO 27001, and OWASP guidance.
• Assist with internal and external audit requests involving cybersecurity and application security controls.
• Maintain clear records of security reviews, findings, remediation activities, exceptions, and risk decisions.
• Contribute to the development and maintenance of security standards, procedures, and technical guidance.

Collaboration & Communication

• Build effective working relationships with application development, infrastructure, cloud, project, and business teams.
• Coordinate with global stakeholders across regions and time zones to support application security activities and priorities.
• Communicate security findings and recommended actions clearly to technical and non-technical audiences.
• Support security awareness activities related to vulnerability management, secure development, and application security practices.
• Seek guidance when needed and actively build technical knowledge through hands-on experience, training, and collaboration.

Required Qualifications & Experience: To be considered for this position, you must possess the following qualifications:

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Engineering, or a related discipline
• 1-3 years of experience in cybersecurity, information security, application support, software development, systems administration, or a related technology field.
• Foundational understanding of cybersecurity principles, vulnerability management, risk management, and security controls.
• Familiarity with application security concepts, including secure coding practices, OWASP Top 10 risks, and the Software Development Lifecycle.
• Exposure to vulnerability assessment, application security testing, or security monitoring technologies.
• Basic understanding of cloud, web application, API, network, and operating system security concepts.
• Familiarity with a scripting or programming language such as PowerShell, Python, JavaScript, Java, or a similar language.
• Strong analytical, organizational, documentation, and problem-solving skills.
• Effective written and verbal communication skills and the ability to collaborate with globally distributed teams.
• Ability to work primarily during U.S. business hours, with periodic schedule flexibility for global collaboration or critical security events.

Desired Qualifications: To be considered an ideal candidate, you should possess some or all of the following qualifications:

• Internship or professional experience supporting cybersecurity, application development, DevOps, cloud, infrastructure, or vulnerability management activities.
• Familiarity with SAST, DAST, SCA, API security testing, dependency scanning, or penetration testing tools.
• Exposure to CI/CD pipelines, source code repositories, cloud platforms, containers, or modern application architectures.
• Knowledge of NIST, CIS Controls, ISO 27001, OWASP, or similar security frameworks and guidance.
• Entry-level or associate security certification such as Security+, SSCP, GSEC, Azure Security Engineer Associate, or a comparable credential.
• Experience working in a manufacturing, industrial, or globally distributed organization.

• This position is part of BlueScope North America and operates primarily during U.S. business hours.
• The role supports global application security responsibilities and requires collaboration with stakeholders in multiple regions and time zones.
• Periodic work outside standard U.S. business hours may be required for planned global collaboration or critical security events.
• BlueScope embraces flexible working arrangements where possible and mutually agreed.

Additional Information
The preceding job responsibilities and tasks were designed to indicate the general nature and level of work performed by associates in this job.  It is not designed to contain or be interpreted as a comprehensive inventory of all job duties and responsibilities required of associates assigned to this job.  Associates may be required to perform other duties as assigned.  Additional job competencies, individual goals, and performance measurements are set at the department level.

The benefits are just as rewarding as the work at BlueScope.  To support our goal, we offer a total compensation plan and an outstanding benefits package that includes health insurance, life insurance, short and long term disability, paid time off, and retirement. 

EEO: Employer/M/F/Disabled/Protected Veteran

BlueScope is an equal opportunity employer.  All qualified applicants will receive consideration for employment without regard to race, religion, color, national origin, sex, sexual orientation, gender identity, age, status, as a protected veteran, among other things, or status as a qualified individual with disability.