Application Security Engineer

Job Title: Application Security EngineerExperience Required: 5+ YearsLocation: HyderabadShifts: General Shift & UK Shift (Rotational)Notice Period: Immediate Joiners OnlyCab Facility: Available

Job Overview

Application Security Engineer

Key Responsibilities

• Conduct Attack Surface Discovery and Penetration Testing across applications, networks, cloud environments, and infrastructure.
• Perform web application, API, mobile, and IoT penetration testing using both manual and automated techniques.
• Execute threat modeling and secure code reviews to identify potential vulnerabilities early in the SDLC.
• Lead and execute red team exercises to simulate real-world attacks and identify systemic weaknesses.
• Perform both credentialed and non-credentialed DAST scans on internal and external client environments.
• Define test scopes, objectives, and timelines; report results using actionable metrics and dashboards.
• Deliver technical security briefings and reports tailored for both technical and non-technical audiences.
• Support the creation and evolution of an organization-wide Application Security (AppSec) program.
• Research emerging attack vectors and offensive techniques to stay ahead of threat trends.
• Review, validate, and provide feedback on security documentation and artifacts.
• Conduct cloud penetration testing methodologies across platforms like AWS, GCP, and Azure.
• Prepare and present clear, concise technical reports with recommendations for mitigation or remediation.
• Collaborate with developers and DevOps to integrate security in CI/CD pipelines.
  

Qualifications

• Education: Bachelor's degree in Engineering, Computer Science, or related technology field.
• Certifications (Preferred): OSCP, OSCE, OSWE, CEH, GPEN, GWAPT, GXPN, GCIH.
  

Required Skills & Experience

• 4+ years of hands-on experience in offensive security roles including penetration testing, red teaming, or AppSec.
• Solid understanding of the Secure Development Lifecycle (SDLC) and vulnerability management.
• In-depth knowledge of application vulnerabilities (OWASP Top 10) and various attack vectors.
• Hands-on experience with tools such as Nmap, Metasploit, Kali Linux, Burp Suite Pro, Cobalt Strike, AppDetective, WebInspect, etc.
• Expertise in conducting cloud penetration testing (AWS, GCP, Azure).
• Strong background in mobile app security testing (Android/iOS) and microservices-based environments.
• Ability to exploit vulnerabilities in applications written in C++, Java, JavaScript, Go, Python.
• Understanding of container security and infrastructure (e.g., Kubernetes, namespaces, memory management, cgroups).
• Programming/scripting proficiency in one or more: Golang, Python, Java, JavaScript, C++, C.
• Passion for security research, code analysis, and solving complex security challenges.