Application Security Engineer

About the Role

We are looking for an Application Security Engineer with expertise in both application development and cybersecurity. The candidate should have hands-on experience in VAPT, secure coding, and security assessments of web applications, APIs, and mobile applications. The role also involves direct client communication, coordinating security activities, and ensuring timely remediation of identified vulnerabilities.

Key Responsibilities

• Conduct VAPT for web applications, REST APIs, and mobile applications.
• Identify vulnerabilities based on OWASP Top 10, OWASP API Security Top 10, and mobile application security best practices.
• Develop, maintain, and review secure web applications, backend services, and APIs.
• Perform source code reviews and implement secure coding practices.
• Assess authentication, authorization, session management, API security, and data protection mechanisms.
• Evaluate application deployment configurations, Docker containers, and Kubernetes environments for security issues.
• Integrate security testing tools and automated security checks into CI/CD pipelines.
• Prepare VAPT reports, recommend remediation measures, and validate fixes.
• Collaborate with development, DevOps, and infrastructure teams to improve application security.

Requirements & Tech Stack

• Strong programming knowledge in at least one language: Java, Python, JavaScript/TypeScript (Node.js), or .NET.
• Hands-on experience with web application and API VAPT using tools such as Burp Suite, OWASP ZAP, and Postman.
• Knowledge of OWASP Top 10, secure SDLC, secure coding, and source code analysis.
• Familiarity with SAST, DAST, dependency scanning, and CI/CD security.
• Understanding of mobile application security (Android/iOS), Docker, and Kubernetes.
• Knowledge of authentication protocols, JWT, OAuth 2.0, encryption, databases, and API security.

Client Communication & Coordination

• Communicate directly with clients to understand project requirements, discuss technical findings, and recommend appropriate security measures.
• Present VAPT results, security assessments, and project progress clearly and professionally.
• Coordinate with client-side technical teams to resolve security issues, track remediation, and conduct revalidation.
• Manage client expectations, address technical queries, and provide regular project status updates.
• Ensure timely delivery of reports, documentation, and other project deliverables.

Qualifications

• Bachelor's or master's degree in Computer Science, IT, Cybersecurity, or a related field.
• Relevant certifications such as OSCP, OSWE, BSCP, or equivalent are desirable.
• Experience in vulnerability remediation, security automation, and secure application architecture is an advantage.
• Strong communication, problem-solving, and client-handling skills.