Role Summary

Application Security Engineer (VAPT & API) will be responsible for protecting our clients' web applications and APIs by serving as the subject matter expert (SME) for our Web Application Firewall (WAF) service. This role requires a robust offensive security mindset to conduct comprehensive vulnerability assessments, translate findings into effective policies to maintain a robust defense against emerging threats.

Key Responsibilities

- Perform Vulnerability Assessments and light Penetration Testing on client web applications and APIs to identify critical security flaws.

- Deeply understand and provide effective mitigation strategies for common vulnerabilities, including the OWASP Top 10 and OWASP API Security Top 10.

- Evaluate and ensure the security of modern API architectures, including REST and GraphQL, focusing on authentication (e.g., OAuth, JWT), authorization (BOLA/BFLA), and proper data handling.

- Collaborate with application development and DevOps teams to advise on secure coding practices and security architecture improvements.

- Conduct forensic analysis of WAF logs and security events to identify new attack vectors, bypassed rules, and adjust mitigations accordingly.





- Stay current with the latest CVEs and threat intelligence and rapidly deploy compensating WAF controls.

Foundational Expertise

- Minimum 3+ years of experience in an Application Security or Penetration Testing role.

- Expert-level knowledge of HTTP/HTTPS protocols, TCP/IP, and TLS/SSL.

- Proficiency with security tools such as Burp Suite Professional, OWASP ZAP, and various vulnerability scanners.

- Solid understanding of common attack techniques (SQLi, XSS, SSRF, Deserialization, XXE, Command Injection).

- Strong understanding of API security mechanisms and vulnerabilities (e.g., broken object level authorization - BOLA, excessive data exposure).

Desirable (Nice-to-Have) Skills

- Industry certifications such as OSCP, CEH, CISSP, GWEB, or relevant cloud certifications.

- Experience with Bot Management and Layer 7 DDoS mitigation strategies.

- Familiarity with container security and microservices architecture.

- Experience in a client-facing service provider environment.

Pay: ₹400,000.00 - ₹1,000,000.00 per year

Work Location: In person

📌 Security Engineer (VAPT & API Security) (Bhandup)
🏢 PageNTRA Infosec
📍 Bhandup