Security Analyst

About the Role:

We are looking for a highly curious and logical thinker who understands how modern web and application-level architectures work. This role is perfect for someone who loves breaking things to understand how they work — and then reporting it clearly.

You don’t need certifications — we value real skills, out-of-the-box thinking, and hands-on experience with the latest attack vectors and tools.

Responsibilities:

• Perform manual and automated application penetration testing on web apps, mobile apps, APIs, and thick clients
• Understand application logic deeply to identify business logic flaws
• Stay updated with the latest OWASP Top 10, SANS 25, and emerging attack vectors like SSRF chaining, prototype pollution, cloud misconfigurations, and more
• Write custom scripts and automate repeatable tasks to improve testing efficiency
• Clearly document vulnerabilities and communicate them effectively to customers, including risk impact and mitigation strategies
• Work closely with developers and customers to validate fixes and provide secure design suggestions

Requirements:

• Strong understanding of web application architecture (frontend, backend, APIs, authentication/authorization flows)
• Ability to identify and exploit application-level vulnerabilities beyond scanners
• Knowledge of modern attack techniques (SSRF, IDOR, OAuth misconfig, JWT attacks, etc.)
• Familiarity with tools like Burp Suite, Postman, custom scripts (Python/bash), and automation frameworks
• Strong communication skills to report findings professionally and clearly
• Logical thinking, curiosity, and problem-solving mindset