Security Engineer

Experience: 1-2 Years

Location: Noida Sector 125

Key Responsibilities:

• Perform end-to-end penetration testing (black-box, gray-box, white-box) on:
• Web applications
• REST/GraphQL APIs
• Mobile applications (Android/iOS)
• Internal and external infrastructure
• Active Directory environments
• Thick client and thin client applications
• Identify and exploit vulnerabilities such as:
• OWASP Top 10 (Web & API)
• Authentication & authorization bypass
• Business logic flaws
• SSRF, deserialization, IDOR, RCE
• Infrastructure misconfigurations
• Privilege escalation & lateral movement in AD
• Conduct Active Directory security assessments, including:

a. OWASP Top 10 (Web & API)

b. Authentication & authorization bypass

c. Business logic flaws

d. SSRF, deserialization, IDOR

e. Infrastructure misconfigurations

• Perform infrastructure penetration testing:

a. Network enumeration and exploitation

b. Firewall/WAF bypass techniques

c. VPN security assessment

d. Cloud misconfiguration testing (if applicable)

• Conduct mobile application security testing:

a. Static and dynamic analysis

b. SSL pinning bypass

c. Insecure storage testing

d. Runtime manipulation

• Perform thick client security testing:

a. Binary analysis

b. Traffic interception

c. Local privilege testing

d. Insecure deserialization and logic abuse

• Conduct basic reverse engineering:

a. Analyze binaries using tools like IDA/Ghidra

b. Identify hardcoded secrets, insecure crypto, and logic flaws

c. Modify application behavior for security validation

• Develop proof-of-concept exploits to demonstrate impact
• Prepare detailed technical reports including risk ratings (CVSS), exploitation steps, and remediation guidance
• Conduct re-testing to validate remediation fixes
• Collaborate with developers, infrastructure, and DevOps teams to remediate vulnerabilities
• Stay current with emerging exploit techniques, attack frameworks, and offensive security research

Required Skills & Qualifications:

• Bachelor’s degree in Computer Science, Information Security, or related field
• 2–3 years of hands-on experience in penetration testing or offensive security
• Strong understanding of:

a. TCP/IP, DNS, VPNs, Firewalls

b. Authentication protocols (NTLM, Kerberos, OAuth, JWT)

c. Web technologies (HTTP/HTTPS, sessions, cookies, CORS)

• Hands-on experience with tools such as:

a. Burp Suite (Professional preferred)

b. Nmap

c. Metasploit

d. BloodHound

e. Mimikatz

f. Wireshark

g. Postman (API testing)

h. MobSF / Frida (mobile testing)

Mandatory certifications such as:

CEH and eJPT

Pay: ₹450,000.00 - ₹500,000.00 per year

Work Location: In person