Application Security Engineer (VAPT)

Role & responsibilities

• Perform VAPT on web applications and APIs
• Find and prove vulnerabilities in authentication, authorization, sessions, access control and business logic
• Detect SQL Injection, XSS, CSRF, IDOR/BOLA, insecure APIs, data exposure and misconfigurations
• Find logic flaws that automated scanners miss
• Review source code and flag insecure coding practices
• Write clear reports with impact, evidence, reproduction steps and fix recommendations
• Work with developers to fix issues, then retest
• Keep up with new application-security threats and techniques

Preferred candidate profile

• 2+ years in Application Security, VAPT or Penetration Testing
• Strong knowledge of OWASP Top 10 and API security
• Hands-on experience with Burp Suite, OWASP ZAP, Postman, Nmap or similar tools
• Good understanding of HTTP/HTTPS, authentication, authorization, APIs and SQL
• Able to read code and understand how an application is built
• Strong analytical mindset, able to think like an attacker
• Knowledge of .NET / C# or another web stack is a plus
• CEH, eJPT or OSCP is a plus but not required
• Immediate joiners or notice period up to 30 days preferred
• Willing to work on-site in Vadodara

Perks and benefits

• Performance-based incentives
• Paid leave and holidays