Security Researcher (Web Application)

Job Summary

Security Brigade is hiring a Security Researcher to join our application security practice. You will run hands-on web application penetration tests for enterprise customers across BFSI, fintech, healthcare, and SaaS - backed by our Lemon audit-management platform and reviewed through our L1/L2/L3 senior chain so you grow under structured supervision from day one. You will own the full lifecycle: scoping with the customer, executing the test, documenting findings with proof-of-concept evidence, walking remediation owners through fixes, and revalidating closures. The role is a strong fit for engineers two to four years into application security who want depth - and a direct path to senior research as we scale.

Responsibilities

• Run web application penetration tests end-to-end on customer applications
• Apply manual testing techniques alongside Burp / OWASP ZAP / custom tooling - automated scanners are a start, not a finish
• Document findings with clear proof-of-concept, business impact, and remediation guidance - written for engineering teams to act on
• Walk customer engineering teams through findings; advise on fixes; revalidate closures
• Contribute to internal research, methodology updates, and Lemon platform improvements

Requirements

• 2+ years of hands-on web application penetration testing experience
• Strong working knowledge of OWASP Top 10 (web) and common business-logic flaw patterns
• Proficient with Burp Suite (Pro a plus), and comfortable writing custom payloads / extensions where needed
• Comfortable reading and reasoning about modern application stacks (React / Angular / Vue front-ends; Node / Django / Rails / Spring back-ends; REST + GraphQL APIs)
• Excellent written English for report-quality output
• Practical lab experience on Hack The Box, PortSwigger Web Security Academy, or TryHackMe a strong signal

Quick Facts

• Team: Application Security
• Location: Mumbai / Remote
• Type: Full-time
• Level: Mid

Disclaimer: This job posting & location has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.