Application Security Engineer

Role & responsibilities:-

KEY RESPONSIBILITY AREAS (KRA)

• Execute hybrid and fully automated penetration testing across web applications and APIs in line with the agreed testing schedule.
• Configure and operate authenticated and unauthenticated dynamic application security testing using Fortify on Demand, OWASP ZAP, Burp Suite, and Qualys WAS.
• Validate and triage automated scan output, eliminate false positives, and confirm exploitability before findings are reported.
• Assign severity to findings using CVSS and application context, and prepare findings for peer review.
• Produce penetration test reports with OWASP-mapped findings, reproduction steps, and remediation guidance.
• Perform retest validation following remediation closure and document whether fixes are effective.
• Support Senior Engineers on manual testing of critical applications, taking ownership of defined test areas.
• Maintain scan configurations, authentication profiles, and application inventory records to ensure accurate testing scope.
• Track application security findings through to closure in the client workflow system and escalate at-risk items ahead of SLA breach.
• Support walkthrough sessions with development teams and capture remediation actions and owners.
• Contribute to the application testing schedule, coverage tracking, and monthly application security reporting inputs.
• Participate in shadowing, reverse-shadowing, and assisted-operation phases of knowledge transfer during mobilisation and transition.

KEY PERFORMANCE INDICATORS (KPIs)

• Assessment execution rate against the planned testing schedule.
• Report delivery timeliness following completion of testing.
• False-positive rate in reported findings.
• Severity rating precision, measured by severity upheld on peer review.
• Retest completion timeliness following receipt of remediation evidence.
• Application testing coverage contribution against the annual portfolio plan.
• Timeliness of escalation for at-risk findings ahead of SLA breach.
• Accuracy and timeliness of reporting inputs and coverage tracking.

REQUIRED TECHNICAL SKILLS & EXPERIENCE

• Hands-on application penetration testing experience across web applications and APIs.
• Working knowledge of OWASP Top 10 and OWASP API Security Top 10, with practical testing experience against each category.
• Proficiency with Burp Suite and OWASP ZAP for manual request manipulation and guided testing, with exposure to Fortify on Demand or Qualys WAS an advantage.
• Understanding of CVSS v3.x scoring and the application context factors that influence severity.
• Working understanding of authentication and session management technologies including OAuth, JWT, and SAML.
• Basic scripting (Python, PowerShell, or Bash) for test support, data handling, and report automation.
• Familiarity with IT service management and ticketing tools, with ServiceNow and Azure Boards preferred, for finding lifecycle tracking.
• Clear written and verbal communication for reporting findings and coordinating with development teams.