Application Security Engineer (Security Consultant)

Key Responsibilities

Penetration Testing Offensive Security

• Plan and execute full-scope penetration tests across web applications, APIs, mobile apps, cloud infrastructure, and internal networks.

• Conduct threat modelling exercises and attack surface analysis for client applications and platforms.

• Perform manual and tool-assisted vulnerability assessments, including business logic flaws, authentication bypasses, injection attacks, and privilege escalation chains.

• Develop proof-of-concept exploits and document findings with clear, actionable remediation guidance tailored to the clients tech stack.

• Simulate real-world adversarial scenarios (red team operations) targeting people, processes, and technology.

Application Security DevSecOps

• Embed security into SDLC processes by designing and implementing Secure-SDLC frameworks, security gates, and shift-left practices.

• Integrate and tune SAST, DAST, SCA, IaC scanning, and secrets detection tools within CI/CD pipelines (GitHub Actions, GitLab CI, Jenkins, Azure DevOps).

• Review source code for security vulnerabilities across languages such as Python, Java, JavaScript/TypeScript, Go, and C#.

• Define and implement API security controls, including OAuth 2.0/OIDC configurations, rate limiting, and input validation frameworks.

• Conduct secure architecture reviews, threat modelling workshops (STRIDE, PASTA, LINDDUN), and cloud security assessments (AWS, Azure, GCP).

• Develop and deliver security training and awareness sessions for engineering, QA, and product teams.

Consulting Client Engagement

• Act as the primary security point of contact for client engagements, managing stakeholder expectations and communication throughout the project lifecycle.

• Produce high-quality deliverables including executive reports, technical findings, remediation roadmaps, and security architecture diagrams.

• Contribute to pre-sales activities, including scoping calls, proposal development, and RFP responses.

• Collaborate with internal teams to develop new service offerings, training content, and thought leadership materials.

Qualifications Required

• 5 8 years of hands-on security experience, with demonstrable depth in both penetration testing and application security / DevSecOps.

• Proficiency with industry-standard offensive security tools: Burp Suite Pro, Metasploit, Nmap, Nessus/OpenVAS, BloodHound, Cobalt Strike (or equivalents).

• Strong knowledge of OWASP Top 10 (Web API), CWE/SANS Top 25, MITRE ATTCK, and CVSS scoring.

• Experience with at least one major cloud platform (AWS, Azure, or GCP) and familiarity with cloud-native services, IAM misconfigurations, and serverless security.

• Hands-on experience integrating security tooling (SAST, DAST, SCA, secrets scanning) into CI/CD pipelines.

• Solid scripting skills in Python, Bash, or PowerShell for automation and custom tooling.

• Excellent written and verbal communication able to present technical findings to both engineering teams and C-suite executives.

Preferred

• Relevant certifications: OSCP, OSEP, BSCP, GWAPT, GWEB, CEH, CSSLP, AWS Security Specialty, or equivalent.

• Familiarity with compliance frameworks: SOC 2, ISO 27001, PCI-DSS, NIST CSF, or CIS Controls.

• Experience with container security (Docker, Kubernetes), service mesh, and zero-trust architecture.

• Prior consulting or client-facing experience in a professional services environment.

• Contributions to open-source security projects, CVE disclosures, or published security research.

What We Offer

Compensation Benefits

• Competitive salary benchmarked globally

• Performance-linked annual bonus

• Paid time off + regional public holidays

Growth Culture

• Annual certification training budget

Disclaimer: This job posting and Location has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.