Roles Responsibilities
Perform comprehensive Security Testing and Assessment activities across applications, APIs, cloud environments, and supporting infrastructure.
Execute Dynamic Application Security Testing (DAST), Vulnerability Assessments, and Security Validation activities using industry-standard tools and methodologies.
Conduct manual and automated security testing to identify vulnerabilities related to authentication, authorization, session management, encryption, access controls, and business logic flaws.
Assess applications against industry standards and frameworks such as OWASP Top 10, OWASP API Security Top 10, CWE, NIST, and SANS.
Identify, analyze, prioritize, and document security vulnerabilities with detailed risk ratings, business impact analysis, and remediation guidance.
Perform false-positive analysis, vulnerability validation, and retesting to verify remediation effectiveness.
Validate implementation of security controls including identity and access management, multifactor authentication, secrets management, data protection, cryptographic controls, and secure communication mechanisms.
Collaborate closely with Development, Architecture, QA, and DevSecOps teams to promote secure coding practices and integrate security into the Software Development Life Cycle (SDLC).
Perform security reviews, threat assessments, and risk-based security evaluations for new and existing applications.
Participate in vulnerability management activities including triage, tracking, risk acceptance reviews, and remediation validation.
Prepare detailed security assessment reports and effectively communicate findings, risks, and recommendations to technical and non-technical stakeholders.
Conduct false-positive analysis and provide remediation recommendations.
Validate authentication, authorization, session management, encryption, and access control mechanisms.
Technical Requirement
3+ years of experience in Application Security Testing, Vulnerability Assessment, and Security Validation.
Strong hands-on experience with DAST tools such as Burp Suite Pro, HCL AppScan, Acunetix, Netsparker, or equivalent.
Solid understanding of Web, API, and Cloud Security concepts.
Knowledge of OWASP Top 10, OWASP API Security Top 10, CVSS, CWE, and Secure SDLC practices.
Experience in vulnerability reporting, risk analysis, remediation validation, and stakeholder communication.
Understanding of authentication protocols such as OAuth 2.0, OpenID Connect (OIDC), SAML, JWT, and MFA.
Experience with Cloud Security (Azure/AWS/GCP) and container security assessments.
Exposure to SAST, SCA/OSS Security Testing, API Security Testing, and Threat Modeling methodologies.
Educational Requirement Bachelor of Engineering
Preferred Skills Technology->Mobile Automation Testing->Mobile Test Automation process,Technology->Test Automation->Selenium-Java,Technology->Security Testing->Security Testing
Service Line Infosys Quality Engineering
