Role Summary

Application Security Engineer (VAPT & API) will be responsible for protecting our clients' web applications and APIs by serving as the subject matter expert (SME) for our Web Application Firewall (WAF) service. This role requires a strong offensive security mindset to conduct comprehensive vulnerability assessments, translate findings into effective policies to maintain a robust defense against emerging threats.

Key Responsibilities
- Perform Vulnerability Assessments and light Penetration Testing on client web applications and APIs to identify critical security flaws.
- Deeply understand and provide effective mitigation strategies for common vulnerabilities, including the OWASP Top 10 and OWASP API Security Top 10.
- Evaluate and ensure the security of modern API architectures, including REST and GraphQL, focusing on authentication (e.g., OAuth, JWT), authorization (BOLA/BFLA), and proper data handling.
- Collaborate with application development and DevOps teams to advise on secure coding practices and security architecture improvements.




- Conduct forensic analysis of WAF logs and security events to identify new attack vectors, bypassed rules, and adjust mitigations accordingly.
- Stay current with the latest CVEs and threat intelligence and rapidly deploy compensating WAF controls.

Foundational Expertise
- Minimum 3+ years of experience in an Application Security or Penetration Testing role.
- Expert-level knowledge of HTTP/HTTPS protocols, TCP/IP, and TLS/SSL.
- Proficiency with security tools such as Burp Suite Professional, OWASP ZAP, and various vulnerability scanners.
- Solid understanding of common attack techniques (SQLi, XSS, SSRF, Deserialization, XXE, Command Injection).
- Solid understanding of API security mechanisms and vulnerabilities (e.g., broken object level authorization - BOLA, excessive data exposure).

Desirable (Nice-to-Have) Skills
- Industry certifications such as OSCP, CEH, CISSP, GWEB, or relevant cloud certifications.
-

📌 Security Engineer (Bhandup)
🏢 PageNTRA Infosec
📍 Bhandup