Associate Consultant

Application Security Tester

Key Responsibilities:

• Perform

  penetration testing

  on web, mobile, network, and infrastructure environments to uncover security weaknesses.
• Understand client requirements, plan security tests, and create penetration methods, scripts, and scenarios.
• Conduct

  source code reviews

  to identify security flaws, coding errors, and compliance issues.
• Perform

  static analysis

  and provide clear remediation guidance aligned with industry best practices.
• Validate fixes to ensure vulnerabilities are resolved without introducing new risks.
• Analyze third-party libraries and dependencies for vulnerabilities and licensing risks and recommend secure upgrades.
• Simulate real-world security breaches to assess system resilience and business impact.
• Support integration of

  security tools

  into CI/CD pipelines for continuous monitoring.
• Assist in

  risk assessments, threat modeling, and audit compliance

  initiatives.
• Document findings, prepare reports, and present results to technical and management stakeholders.
• Provide advisory on mitigating risks and strengthening application and infrastructure security.
• Stay up to date with the latest

  emerging threats, vulnerabilities, and security standards

  .

Required Skills & Qualifications:

• Strong knowledge of

  penetration testing methodologies

  and common attack techniques.
• Experience with

  source code review tools

  (e.g., SonarQube, Checkmarx, Fortify) and manual secure code review practices.
• Familiarity with

  scripting languages

  (Python, Bash, PowerShell, etc.) and secure coding principles.
• Understanding of

  network protocols, web technologies, APIs, and operating systems

  .
• Hands-on experience with

  security testing tools

  such as Burp Suite, OWASP ZAP, Metasploit, Nessus, etc.
• Knowledge of

  CI/CD pipeline security integration

  and DevSecOps practices.
• Strong problem-solving skills with the ability to clearly communicate findings and risks.

Relevant certifications - CEH, OSCP/SANS 25, LPT, CEPT or equivalent.

Note