Technology Engineer - JAVA/.NET/Security Code Review at PNC
Denver, CO
$86,250–$158,125from the description
Jul 14, 2026
Denver, CO
Jul 21, 2026
What this job asks for AI summary
This role sits within application security, focused on identifying and reducing security risks across the software development lifecycle. Day-to-day work involves triaging and remediating web application vulnerabilities, validating compensating controls, and partnering with engineering teams to embed secure coding practices. A background in software development — particularly Java or .NET — combined with solid knowledge of common web application risks is central to the position.
Mid level · 3+ years · Pittsburgh, PA · Full-time
“or” means any one of them counts — you don't need all of them.
We read this from the posting text with AI. Skim the description below before ruling yourself out.
How this req sits in the market our data
Roughly 65 people in the Pittsburgh, PA area plausibly meet what this posting asks for (information security analysts). range 20–100
Applicant volume Moderate — A normal amount of company. The rare requirements below are what will separate a shortlisted application from the rest.
Most people in this occupation already list these. Still required — just not what gets you shortlisted.
What the occupation pays Median $105,909 (middle half $83,067–$132,910). This posting is about at that midpoint.
Estimated from BLS employment for this occupation and area, per-skill prevalence across our listing corpus, and published wage benchmarks — as of Jul 28, 2026. It is a model, not a headcount.
Why we read it this way (9)
The role is posted across five metro locations (Pittsburgh PA; Cleveland OH; Birmingham AL; Dallas TX; Lakewood CO) with no remote option; Pittsburgh is listed first and is PNC's headquarters.
SOC classification is a genuine judgment call: the day-to-day work is application security analysis and vulnerability triage (15-1212), but the JD also requires a software development background and involves hands-on secure-coding collaboration, making 15-1252 a credible runner-up.
Java and .NET are presented as interchangeable ('Java and/or .NET') under a required software development background, so they are captured as a single skill with .NET as the alternative.
IAST is explicitly called 'preferred but not mandatory' in the posting body.
Incident response experience is described as 'an advantage,' so it is treated as preferred.
Machine Learning appears only in the 'Preferred Skills' section of the formal qualifications block.
The degree requirement states 'Bachelors' but explicitly allows 'a comparable combination of education, job specific certification(s), and experience' in lieu of a degree, so the degree requirement is set to None.
The salary range ($86,250–$158,125/year) is broad and noted as variable by geography and individual factors; the role is also described as incentive-eligible.
Ignored 1 non-technology phrase(s) as skills (responsibilities/concepts, not named tools): web application vulnerability remediation.
Read the full posting
The employer publishes the full description on their own site — read it there ↗. Or sign in to read it here — it's free, and it also lets you track this application.