Application Security Engineer

About the Role

We are seeking an experienced Application Security Engineer with 5\+ years of experience in application security, secure software development, vulnerability assessment, penetration testing, and DevSecOps. The ideal candidate will be responsible for identifying, assessing, and mitigating security vulnerabilities across web applications, APIs, microservices, and cloud\-native applications. The role requires hands\-on experience with application security testing tools, secure coding practices, threat modeling, vulnerability management, and industry standards such as OWASP Top 10, OWASP ASVS, and CWE.

Responsibilities

• Perform application security assessments, vulnerability analysis, and manual security testing.
• Conduct SAST, DAST, and SCA assessments and validate security findings.
• Identify vulnerabilities aligned with OWASP Top 10, OWASP API Security Top 10, and CWE.
• Perform threat modeling, secure code reviews, and application architecture reviews.
• Integrate security tools into CI/CD pipelines and DevSecOps workflows.
• Assess REST APIs, GraphQL APIs, authentication, authorization, and session management.
• Collaborate with developers to prioritize and remediate vulnerabilities.
• Support cloud application security, security automation, and compliance initiatives.
• Prepare security assessment reports and provide remediation recommendations.

Requirements

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field.
• 5\+ years of experience in application security, product security, or penetration testing.
• Strong knowledge of OWASP Top 10, OWASP ASVS, CWE, and common web application vulnerabilities.
• Hands\-on experience with SAST, DAST, and SCA tools.
• Proficiency with tools such as Burp Suite, OWASP ZAP, Checkmarx, Veracode, Fortify, or equivalent platforms.
• Knowledge of REST APIs, OAuth 2\.0, OpenID Connect, JWT, and secure authentication mechanisms.
• Experience with secure coding, vulnerability management, and security testing automation.
• Familiarity with Git, CI/CD pipelines, and DevSecOps practices.
• Strong analytical, communication, and problem\-solving skills.

Nice to Have

• Experience with AWS, Azure, or GCP application security.
• Knowledge of Docker, Kubernetes, and Infrastructure as Code security.
• Experience with Python or other scripting languages.
• Familiarity with mobile application security testing.
• Knowledge of ISO 27001, SOC 2, PCI DSS, or NIST security frameworks.
• Relevant certifications such as CSSLP, GWAPT, OSCP, or CEH

Pay: ₹1,405,000\.00 \- ₹1,710,000\.00 per year

Benefits

• Health insurance
• Life insurance
• Provident Fund

Ability to commute/relocate

• Bangalore City, Bengaluru, Karnataka: Reliably commute or planning to relocate before starting work (Preferred)

Experience

• Application Security: 5 years (Required)

Work Location: Hybrid remote in Bangalore City, Bengaluru, Karnataka