Application Security Engineer

Key Responsibilities

• Manage and execute the annual security testing program for existing and new production systems.
• Plan, coordinate and conduct Application Security Assessments and Penetration Testing activities.
• Perform security testing of Web Applications, APIs and Mobile Applications.
• Conduct Android and iOS Mobile Application Security Testing, including identification of application-level and platform-specific vulnerabilities.
• Perform vulnerability assessment and penetration testing using industry-standard methodologies and tools.
• Identify, validate, document and track security vulnerabilities through to remediation.
• Prepare detailed security assessment and penetration testing reports, including vulnerability impact, evidence, severity and remediation recommendations.
• Maintain and manage the security testing tools, environments and infrastructure required for application security assessments.
• Work closely with internal development, infrastructure, application and security teams to support security testing activities.
• Coordinate with external security consultants/vendors wherever required for specialized assessments.
• Conduct SAST, DAST, IAST and SCA activities and analyze findings to identify genuine security risks.
• Perform manual security testing to validate automated tool findings and identify vulnerabilities that may not be detected through automated scans.
• Use tools such as Burp Suite, Kali Linux and other application security testing tools for vulnerability discovery and exploitation.
• Track security issues and vulnerabilities and coordinate with application teams for timely remediation.
• Perform re-testing/validation of vulnerabilities after remediation to ensure effective closure.
• Stay updated with emerging application security threats, vulnerabilities, attack techniques and industry best practices.

Required Technical Skills

• 34 years of hands-on experience in Application Security Assessment and Penetration Testing.
• Strong experience in Web Application Security Testing.
• Hands-on experience in API Security Testing.
• Hands-on experience in Mobile Application Security Testing – Android and iOS.
• Good understanding of OWASP Top 10 and common application security vulnerabilities.
• Experience with:
• Burp Suite
• Kali Linux
• SAST
• DAST
• IAST
• SCA
• Strong understanding of common vulnerabilities such as:
• SQL Injection
• Cross-Site Scripting (XSS)
• Authentication & Authorization issues
• Broken Access Control
• SSRF
• CSRF
• API Security vulnerabilities
• Insecure Cryptography
• Security Misconfiguration
• Sensitive Data Exposure
• Business Logic vulnerabilities
• Knowledge of mobile application security concepts, including Android and iOS application architecture, data storage, authentication, API communication and reverse engineering concepts.
• Ability to manually validate and exploit vulnerabilities rather than relying solely on automated scanners.
• Good understanding of vulnerability severity, risk assessment and remediation practices.

Preferred Skills

• Knowledge of OWASP ASVS, OWASP MASVS and OWASP API Security Top 10.
• Experience with mobile security testing tools such as MobSF, Frida, JADX, APKTool or equivalent.
• Understanding of Android APK and iOS IPA analysis.
• Knowledge of source-code and dependency security analysis.
• Experience working with vulnerability management/ticketing platforms.
• Security certifications such as OSCP, CEH, eJPT, GWAPT, OSWE or equivalent would be an advantage.