Be an Early Applicant
We help people secure their future and protect the ones they love.
The Role
Own and mature the organization’s DAST program by configuring tools, running authenticated tests against web applications and APIs, integrating testing into CI/CD pipelines, and validating vulnerabilities. The role also performs manual security assessments, threat modeling, code review, and SAST/SCA oversight; guides remediation; supports secure architecture, incident response, compliance, developer education, and executive risk reporting.
Summary Generated by Built In
Application Security Consultant - DAST
Enterprise Cyber Security
Full Time, Springfield - MA
The Opportunity
We are seeking a highly skilled and experienced Application Security Consultant to advance our application security initiatives, with a particular emphasis on dynamic application security testing (DAST). You will own and mature how we test running applications and APIs for exploitable weaknesses, drive secure development practices, and implement solutions that protect our systems and data from evolving threats. The role partners with development teams, security architects, leadership, and other stakeholders to embed security into every stage of the software development lifecycle.
The Team
Our Application Security team keeps MassMutual's software applications secure through rigorous assessment and proactive development team engagements. We work closely with security architects, DevOps engineers, and software developers, while our core focus is identifying and verifying vulnerabilities - including hands-on dynamic testing of running applications and APIs - implementing security best practices, and helping development teams remediate. Our backgrounds span software engineering to red teaming, and we value continuous learning, innovation, and collaboration.
The Impact
Your key responsibilities will ensure applications are resilient against emerging threats, reducing the financial and reputational damage of security incidents.
The Minimum Qualifications
The Ideal Qualifications
#LI-RK1
MassMutual is an equal employment opportunity employer. We welcome all persons to apply.
If you need an accommodation to complete the application process, please contact us and share the specifics of the assistance you need.
California residents: For detailed information about your rights under the California Consumer Privacy Act (CCPA), please visit our California Consumer Privacy Act Disclosures page.
Salary Range: $137,800-$180,800
Enterprise Cyber Security
Full Time, Springfield - MA
The Opportunity
We are seeking a highly skilled and experienced Application Security Consultant to advance our application security initiatives, with a particular emphasis on dynamic application security testing (DAST). You will own and mature how we test running applications and APIs for exploitable weaknesses, drive secure development practices, and implement solutions that protect our systems and data from evolving threats. The role partners with development teams, security architects, leadership, and other stakeholders to embed security into every stage of the software development lifecycle.
The Team
Our Application Security team keeps MassMutual's software applications secure through rigorous assessment and proactive development team engagements. We work closely with security architects, DevOps engineers, and software developers, while our core focus is identifying and verifying vulnerabilities - including hands-on dynamic testing of running applications and APIs - implementing security best practices, and helping development teams remediate. Our backgrounds span software engineering to red teaming, and we value continuous learning, innovation, and collaboration.
The Impact
Your key responsibilities will ensure applications are resilient against emerging threats, reducing the financial and reputational damage of security incidents.
- Own and advance our dynamic application security testing (DAST) program - selecting, deploying, configuring, and maintaining DAST tooling across our web application and API estate.
- Design and run authenticated dynamic scans against complex applications, including session handling, multi-step workflows, single-page applications, and REST/GraphQL APIs.
- Integrate DAST into CI/CD pipelines and pre-production environments so dynamic testing runs continuously rather than as a point-in-time exercise, and define the thresholds that gate a release.
- Triage, validate, and tune DAST output - eliminating false positives, confirming exploitability through manual verification, and translating findings into actionable remediation guidance for development teams.
- Complement automated dynamic testing with manual techniques to identify, risk-assess, and prioritize application-level vulnerabilities (e.g., OWASP Top 10) that scanners alone do not surface.
- Conduct in-depth security assessments, including vulnerability scanning and code review.
- Conduct detailed threat modeling to identify attack vectors and potential weaknesses, and use the results to focus dynamic test coverage where risk is highest.
- Collaborate with security architects to design secure application architectures aligned to industry best practices, ensuring secure coding practices are followed and security controls are built into software designs.
- Partner with our SDLC Council to develop and maintain secure coding standards that empower developers to integrate security into their own workflow.
- Partner with DevOps teams to implement security controls within CI/CD pipelines for automated, seamless deployment of secure code.
- Maintain the broader application security testing toolchain, including static analysis (SAST) and software composition analysis (SCA), alongside DAST.
- Evaluate third-party software and APIs for security compliance, including dynamic testing of externally sourced components where appropriate.
- Support incident response for application security events, providing rapid identification and mitigation guidance.
- Ensure compliance with applicable security regulations, frameworks, and industry standards.
- Use reporting tools to communicate vulnerability and code-defect risk to MassMutual's cyber assets through metrics (KPIs, KRIs, OKRs), enabling team leaders and executive leadership to make risk-based prioritization decisions.
- Educate developers and stakeholders on secure coding practices and on interpreting and acting on dynamic test results.
- Stay current on security threats, vulnerabilities, and industry trends, and apply them to improve our security strategy.
The Minimum Qualifications
- Bachelor's Degree
- 8+ years of experience in application security, penetration testing, or secure software development.
The Ideal Qualifications
- Deep, hands-on expertise with DAST tooling (e.g., Burp Suite, OWASP ZAP, Invicti, Acunetix, StackHawk) including authenticated scan configuration, scan policy tuning, and API scanning.
- Demonstrated hands-on experience with dynamic application security testing (DAST) of web applications and APIs.
- Experience operationalizing DAST at scale - pipeline integration, scheduled scanning across a large application estate, results triage workflows, and reducing false-positive rates over time.
- Relevant security certifications such as CEH, OSCP, CISSP, or GWAPT from an industry-recognized certifier (e.g., SANS/GIAC, CompTIA, ISACA, ISC2).
- Strong knowledge of secure software development methodologies, including threat modeling, code review, and static/dynamic analysis.
- Deep understanding of common application vulnerabilities (e.g., OWASP Top 10) and their mitigations, with the ability to manually verify and exploit findings to confirm real risk.
- Experience integrating security into DevOps (DevSecOps) and CI/CD environments.
- Strong technical knowledge of web application security, cloud security (AWS, Azure, GCP), mobile security, infrastructure as code, containerized environments (Docker, Kubernetes), and API security.
- Hands-on experience across the wider testing toolchain - SAST, SCA, IAST, and fuzzing tools.
- Experience identifying security defects in container images and Kubernetes environments.
- Advanced proficiency writing source code in at least one programming language (e.g., Java, JavaScript, C/C++/C#, Python) and familiarity with common build and dependency tooling (e.g., Maven, Gradle, Node).
- Experience with cloud deployment and automation tooling (Terraform, GitHub Actions, Jenkins, AWS CloudFormation, secrets managers).
- Working knowledge of encryption, authentication, and access control.
- Knowledge of compliance and regulatory frameworks (e.g., SOC 2).
- Strong analytical and problem-solving ability, with excellent communication skills - able to explain security issues to both technical and non-technical stakeholders.
- A collaborative team player comfortable in a fast-paced environment.
#LI-RK1
MassMutual is an equal employment opportunity employer. We welcome all persons to apply.
If you need an accommodation to complete the application process, please contact us and share the specifics of the assistance you need.
California residents: For detailed information about your rights under the California Consumer Privacy Act (CCPA), please visit our California Consumer Privacy Act Disclosures page.
Salary Range: $137,800-$180,800
Skills Required
- Bachelor's degree
- 8+ years of experience in application security, penetration testing, or secure software development
- Hands-on expertise with DAST tooling, including authenticated scan configuration, policy tuning, and API scanning
- Hands-on experience performing DAST on web applications and APIs
- Experience operationalizing DAST at scale, including pipeline integration, scheduled scanning, triage workflows, and false-positive reduction
- Security certification such as CEH, OSCP, CISSP, or GWAPT
- Knowledge of secure software development, threat modeling, code review, and static/dynamic analysis
- Deep understanding of OWASP Top 10 vulnerabilities and mitigations, including manual verification and exploitation
- Experience integrating security into DevSecOps and CI/CD environments
- Technical knowledge of web application security, cloud security, mobile security, infrastructure as code, containers, Kubernetes, and API security
- Experience with SAST, SCA, IAST, and fuzzing tools
- Experience identifying security defects in container images and Kubernetes environments
- Advanced proficiency in at least one programming language, such as Java, JavaScript, C, C++, C#, or Python
- Familiarity with Maven, Gradle, Node, or similar build and dependency tooling
- Experience with Terraform, GitHub Actions, Jenkins, AWS CloudFormation, or secrets managers
- Working knowledge of encryption, authentication, and access control
- Knowledge of compliance and regulatory frameworks such as SOC 2
- Strong analytical, problem-solving, communication, and collaboration skills
MassMutual Compensation & Benefits Highlights
How does MassMutual ensure its pay and bonus plans are competitive?
MassMutual provides market-competitive salaries and generous incentive pay opportunities for all employees. Whether an employee is just starting out, transitioning to a new career, or joining us as a seasoned leader — we value their contributions.
- Competitive Salary and Bonus offerings: MassMutual’s base salaries reward and recognize employees’ experience, skills and performance. Our salary ranges are regularly benchmarked within our industry and the broader job market to ensure competitiveness. Additionally, all MassMutual employees have the opportunity to receive competitive, performance-based bonuses, either annually or more frequently.
- Annual Incentive Plan (AIP): AIP awards are discretionary and based on individual and company performance, with opportunities to earn above-target bonuses in years with exceptional results. These awards consider not only what results a person achieved, but how they achieved them, rewarding behaviors that help create a productive and welcoming work environment for everyone.
- Employees in sales roles participate in our variable incentive compensation (VIC) program instead of AIP. VIC provides incentive pay awards commensurate with results for individuals in roles that directly influence sales.
- Employees in sales roles participate in our variable incentive compensation (VIC) program instead of AIP. VIC provides incentive pay awards commensurate with results for individuals in roles that directly influence sales.
- Pay transparency and pay equity: MassMutual publishes salary ranges in job postings and is committed to promoting pay equity. This includes providing pay equity training to managers, reviewing the pay of employees who perform similar work as a standard practice when making compensation recommendations, and partnering regularly with independent external experts to check our work.
- Benefits as part of Total Rewards: MassMutual invests in every aspect of their employees’ well-being, providing a rewards package that goes far beyond a paycheck to support them physically, mentally, and financially. Their robust healthcare, retirement and protection benefits provide a range of support through all of life’s big moments — and, over the years, they have expanded their pioneering leave programs so employees can better care for themselves and the people they love.
- Health benefits: MassMutual offers a comprehensive suite of health and wellness benefits, focusing on solutions that support holistic well-being, aimed at improving access and outcomes for all, and provide flexibility to meet our employees’ and their families’ unique needs. Employees value our wide array of benefits, with one sales assistant citing “great benefits and lots of flexibility,” and another employee describing the company’s “good leadership and benefits.” (MassMutual Careers Benefits; Glassdoor). In a 2026 employee survey, one employee noted “The organization offers a wide range of programs and benefits that meaningfully support employees and foster a positive, inclusive culture.”
- Retirement and financial benefits: MassMutual provides a 401(k) plan contribution of up to 10% of eligible compensation, including up to 5% company match on employee deferrals and, for all eligible employees, a 5% annual company contribution. The company also treats eligible student loan payments like 401(k) contributions for matching purposes. The company provides a Retiree Health Reimbursement Account to eligible employees; monthly credits start at age 45. (MassMutual Careers Benefits; MassMutual 2025 Annual Report)
- Additional health programs: MassMutual offers additional benefits such as a health savings account, access to a broad network of mental health resources and providers for employees and their family members, and resources like medical and surgery decision support, healthcare navigation services, and more. All employees also have access to a Well-Being Wallet, where they can be reimbursed for up to $1,250 per year for eligible physical, mental, or financial wellness related expenses.
- Other benefits: Employees have access to an array of resources to help strengthen their overall well-being and protect the ones they love, at every stage of life. Whether growing their family, volunteering in their community, planning their legacy, or looking to save on everyday expenses like pet or auto insurance, we offer financial benefits and corporate discounts to help.
- Employee Feedback on Benefits: MassMutual conducts regular employee surveys, and benefits continuously receive positive feedback. In their 2026 survey, one employee said “...the total benefits program here at MassMutual has to be one of the best, if not the very best. It seems this company goes out of its way to make sure their employees are well taken care of." With another employee sharing “The Well-Being Wallet, education reimbursement, time off & leave programs are top notch and unlike anything I've experienced”.
- Time off & leaves: MassMutual’s flexible time-off and leave programs support employees’ well-being, help them care for loved ones, and balance personal priorities. Offerings include inclusive caregiver, bereavement, and other essential leaves; generous parental leave and financial support for adoption and surrogacy; up to 24 hours of paid volunteer time annually; and generous vacation, flexible holidays, companywide paid holidays and remote work weeks, and five “take care days.”
- External signals:
- Benefits value: Employees on external review sites regularly highlight benefits as a strength, with reviews calling out “excellent benefits,” “great benefits” and a “great benefits package.” (Glassdoor; Indeed)
- Benefits and retention: Employees surveyed on external review sites rate MassMutual’s perks and benefits an A-, with 100% saying perks and benefits play a role in staying at the company. (Comparably)
Bottom line: MassMutual supports employee wellbeing through competitive salaries and bonus opportunities, strong retirement contributions, and benefits designed to support the financial, physical, and mental well-being of employees and their families.
MassMutual Insights
Am I A Good Fit?
Get Personalized Job Insights.
Our AI-powered fit analysis compares your resume with a job listing so you know if your skills & experience align.
Success! Refresh the page to see how your skills align with this role.
The Company
What We Do
Since 1851, MassMutual’s commitment has always been to help people protect their families, support their communities, and help one another. This is why we want to inspire people to Live Mutual. We’re people helping people. Together, we’re stronger.
Why Work With Us
MassMutual has the financial security and stability of a 170+ year old company, with the culture and energy of a startup. We work every day with the customer front of mind to build the best digital experience in the industry.
Gallery
.JPG)
MassMutual Teams
MassMutual Offices
Hybrid Workspace
Employees engage in a combination of remote and on-site work.
We believe in capitalizing on the best of being together in our offices as well as personal flexibility. Our workplace philosophy puts office collaboration first, combined with flexibility to work remotely.
Typical time on-site:
3 days a week
