Job Summary

Job Summary:

We are seeking a Level 2 Application Security Engineer with hands-on experience in secure application testing and DevSecOps practices. The candidate will be responsible for identifying, analyzing, and mitigating security vulnerabilities in web, API, and mobile applications using SAST, DAST, IAST tools.

Key Responsibilities

Key Responsibilities:

- Perform security testing using SAST, DAST, and IAST tools for web, API, and mobile applications

- Conduct manual security testing and vulnerability validation

- Perform API security assessments (REST, SOAP) and identify vulnerabilities

- Conduct mobile application security assessments (Android/iOS)

- Analyze scan results, eliminate false positives, and provide remediation recommendations

- Integrate AppSec tools into CI/CD pipelines (DevSecOps)

- Work with development teams for secure coding practices and remediation

- Perform threat modeling and risk assessment at application level

- Prepare detailed vulnerability reports and dashboards

- Support compliance and security audits

Skill Requirements

Required Skills:

- Strong knowledge of OWASP Top 10 and API Security Top 10

- Hands-on experience in SAST (Checkmarx, Veracode, SonarQube)

- Hands-on experience in DAST tools (Burp Suite, OWASP ZAP)

- Experience in IAST tools (Contrast Security or similar)

- Good understanding of API security and authentication mechanisms

- Experience in Mobile app security testing

- Knowledge of secure SDLC and DevSecOps practices

- Strong analytical and problem-solving skills

Other Requirements

Good to Have:

- Experience with SCA tools (Snyk, BlackDuck)

- Knowledge of cloud security (Azure/AWS)

- Automation scripting (Python, Bash)

Certifications (Preferred):

- CEH / OSCP / GWAPT / CSSLP

Soft Skills:

- Good communication and stakeholder management

- Ability to work independently and in teams

- Strong documentation and reporting skills