Hi John,
Limited information there but to me an “Application Security Analyst” would be working with one or more applications, their platforms an related upstream/downstream services, components and dependencies to fulfil this list of points I cobbled together:
1. Create, update and maintain the register of risks, vulnerabilities and threats to the application, it’s data and users(more from a technical standpoint than business, but that understanding would be there);
2. They’d look at security by design(possible to look privacy by design as well, but that’s more from an assist) and of course work through inception, through traceable requirements(functional, non-functional and security);
3. They’d likely develop attack trees and would be actively helping to exploit the application as part of the application security testing intially to catch the easy stuff before helping with pen test, red team, blue team activities;
4. They’d help with coding standards, component assurance, security controls (deter, prevent, detect, remediate etc), how does it fit with our security architecture and tooling?
5. they’d be part of the regular review cycles, work with internal audit, compliance, poss even regulators in banking, healthcare etc, they be documenting the security decisions and looking at cost/benefit;
6. They would consider availability of the app for folk of course, but more from a reliability engineering standpoint - the right observability of the right events in a timely manner manner.
I could add more, but from your description of the explanation I feel that it’s likely missing some info, the explanation looks more like app support, or as you say admin - either of the app or the directory service permissions.
cheers.
