Application Security Engineer (Security Consultant)

Key Responsibilities

Penetration Testing & Offensive Security

• Plan and execute full-scope penetration tests across web applications, APIs, mobile apps, cloud infrastructure, and internal networks.
• Conduct threat modelling exercises and attack surface analysis for client applications and platforms.
• Perform manual and tool-assisted vulnerability assessments, including business logic flaws, authentication bypasses, injection attacks, and privilege escalation chains.
• Develop proof-of-concept exploits and document findings with clear, actionable remediation guidance tailored to the client's tech stack.
• Simulate real-world adversarial scenarios (red team operations) targeting people, processes, and technology.

Application Security & DevSecOps

• Embed security into SDLC processes by designing and implementing Secure-SDLC frameworks, security gates, and shift-left practices.
• Integrate and tune SAST, DAST, SCA, IaC scanning, and secrets detection tools within CI/CD pipelines (GitHub Actions, GitLab CI, Jenkins, Azure DevOps).
• Review source code for security vulnerabilities across languages such as Python, Java, JavaScript/TypeScript, Go, and C#.
• Define and implement API security controls, including OAuth 2.0/OIDC configurations, rate limiting, and input validation frameworks.
• Conduct secure architecture reviews, threat modelling workshops (STRIDE, PASTA, LINDDUN), and cloud security assessments (AWS, Azure, GCP).
• Develop and deliver security training and awareness sessions for engineering, QA, and product teams.

Consulting & Client Engagement

• Act as the primary security point of contact for client engagements, managing stakeholder expectations and communication throughout the project lifecycle.
• Produce high-quality deliverables including executive reports, technical findings, remediation roadmaps, and security architecture diagrams.
• Contribute to pre-sales activities, including scoping calls, proposal development, and RFP responses.
• Collaborate with internal teams to develop new service offerings, training content, and thought leadership materials.

Qualifications Required

• 5-8 years of hands-on security experience, with demonstrable depth in both penetration testing and application security / DevSecOps.
• Proficiency with industry-standard offensive security tools: Burp Suite Pro, Metasploit, Nmap, Nessus/OpenVAS, BloodHound, Cobalt Strike (or equivalents).
• Strong knowledge of OWASP Top 10 (Web & API), CWE/SANS Top 25, MITRE ATT&CK, and CVSS scoring.
• Experience with at least one major cloud platform (AWS, Azure, or GCP) and familiarity with cloud-native services, IAM misconfigurations, and serverless security.
• Hands-on experience integrating security tooling (SAST, DAST, SCA, secrets scanning) into CI/CD pipelines.
• Solid scripting skills in Python, Bash, or PowerShell for automation and custom tooling.
• Excellent written and verbal communication - able to present technical findings to both engineering teams and C-suite executives.

Preferred

• Relevant certifications: OSCP, OSEP, BSCP, GWAPT, GWEB, CEH, CSSLP, AWS Security Specialty, or equivalent.
• Familiarity with compliance frameworks: SOC 2, ISO 27001, PCI-DSS, NIST CSF, or CIS Controls.
• Experience with container security (Docker, Kubernetes), service mesh, and zero-trust architecture.
• Prior consulting or client-facing experience in a professional services environment.
• Contributions to open-source security projects, CVE disclosures, or published security research.

What We Offer

Compensation & Benefits

• Competitive salary benchmarked globally
• Performance-linked annual bonus
• Paid time off + regional public holidays

Growth & Culture

• Annual certification & training budget
• Access to required practical DevSecOps courses
• Speak at conferences & publish research