Sr Security Consultant - Web, Mobile, API & SCR

Role Overview

We are looking for an experienced Application Security Tester with 3-6 years of hands-on experience in Web, Mobile, API Security Testing and Secure Code Review (SCR). Experience in BFSI, UPI/payment applications and security compliance will be preferred.

The candidate should have strong technical skills along with exposure to team coordination, client interaction and audit support.

Key Responsibilities

• Perform Web Application Security Testing based on OWASP Top 10 and industry-standard methodologies.
• Conduct Mobile Application Security Testing for Android/iOS.
• Perform API Security Testing using Burp Suite, Postman, OWASP ZAP, etc.
• Conduct Secure Code Review (SCR) and identify insecure coding practices.
• Identify and validate vulnerabilities related to authentication, authorization, access control, injection, session management, sensitive data, business logic and API security.
• Perform vulnerability retesting and remediation validation.
• Prepare detailed VAPT/security assessment reports with evidence, impact and remediation recommendations.
• Perform/support security testing of UPI/payment applications, including API security, transaction flows, authentication, authorization and business logic.
• Support PCI-DSS and other security audits with VAPT reports, evidence, remediation and retest documentation.
• Coordinate with development/application teams for vulnerability remediation and closure.
• Handle client queries and participate in security review meetings.

Team Handling Coordination

• Coordinate day-to-day activities of junior security testers.
• Allocate testing tasks and track assessment deliverables and timelines.
• Review vulnerability findings and reports for quality and technical accuracy.
• Mentor junior team members on application security testing and vulnerability validation.
• Coordinate with project managers, developers, application owners and client stakeholders.
• Support multiple security assessments and track remediation/closure.

Audit Compliance Support

• Support PCI-DSS audits/assessments and client security compliance requirements.
• Prepare audit evidence including VAPT reports, scope, methodology, findings, remediation and retest results.
• Coordinate with auditors and stakeholders for security testing-related queries.
• Maintain assessment documentation and evidence for audit readiness.

Required Skills

• 3-6 years of hands-on Application Security / VAPT experience.
• Strong experience in Web, API and Mobile Security Testing.
• Hands-on experience in Secure Code Review.
• Strong knowledge of OWASP Top 10 and application security fundamentals.
• Understanding of JWT, OAuth, API authentication/authorization and business logic vulnerabilities.
• Hands-on experience with Burp Suite, Postman, MobSF and OWASP ZAP.
• Exposure to Frida / Objection is an advantage.
• BFSI, UPI/payment application and PCI-DSS exposure preferred.
• Good technical report writing, communication and stakeholder management skills.
• Team coordination/mentoring experience preferred.

Certifications - Preferred

• eWPT / eMAPT
• CEH
• OSCP / OSWE
• CREST or equivalent

Practical hands-on experience will be preferred over certification alone.

Qualification

• Bachelors degree in Computer Science / IT / Cybersecurity or equivalent.
• Strong analytical, communication and documentation skills.
• Ability to work in a structured, compliance-driven BFSI environment.

Disclaimer: This job posting and location has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.