The Security Testing SME will lead security testing and vulnerability assessment across web, API, mobile, cloud, and enterprise applications. The role requires deep expertise in DAST, vulnerability assessment, penetration testing, API security, threat modeling, and security testing governance, with responsibility for identifying security risks, guiding remediation, and embedding security testing within the SDLC/DevSecOps lifecycle.

Lead security testing, vulnerability assessment and penetration testing (VAPT) for web, mobile, API, and cloud-based applications.Perform and govern DAST using tools such as Burp Suite, OWASP ZAP, HCL AppScan, Invicti/Acunetix, or equivalent.Assess applications against OWASP Top 10, OWASP API Security Top 10, CWE and CVSS.Conduct manual penetration testing to validate vulnerabilities, exploitability, business impact, and potential attack paths.Define security test strategy, test plans, methodologies, standards, entry/exit criteria, and security quality gates.Test authentication, authorization, session management, input validation, encryption, API endpoints, and business-logic vulnerabilities.Analyze security findings, eliminate false positives, determine severity, and provide actionable remediation recommendations to development teams.Partner with development, architecture, infrastructure and DevOps teams to integrate security testing into CI/CD and DevSecOps pipelines.Perform security reviews for REST/SOAP APIs and microservices, including authentication mechanisms such as OAuth 2.0, JWT and API keys.Support application threat modeling and risk-based security testing using frameworks such as STRIDE.Track vulnerabilities through remediation and retesting, ensuring effective closure of identified security issues.Define security-testing metrics, dashboards and governance reporting for senior stakeholders.Mentor security testers and provide technical guidance for complex vulnerability and penetration-testing scenarios.Support security audits, compliance assessments and customer security reviews.

OSCP / OSWE / CEH / CISSP or equivalent security certificationExperience establishing enterprise-level security-testing frameworks and governance.Strong stakeholder management, technical consulting and security-risk communication skills.Experience leading security assessments for large enterprise environments.