Role Summary

Application Security Engineer (VAPT & API) will be responsible for protecting our clients' web applications and APIs by serving as the subject matter expert (SME) for our Web Application Firewall (WAF) service. This role requires a strong offensive security mindset to conduct comprehensive vulnerability assessments, translate findings into effective policies to maintain a robust defense against emerging threats.

Key Responsibilities
Perform Vulnerability Assessments and light Penetration Testing on client web applications and APIs to identify critical security flaws.
Deeply understand and provide effective mitigation strategies for common vulnerabilities, including the OWASP Top 10 and OWASP API Security Top 10.
Evaluate and ensure the security of contemporary API architectures, including REST and GraphQL, focusing on authentication (e.g., OAuth, JWT), authorization (BOLA/BFLA), and proper data handling.
Collaborate with application development and DevOps teams to advise on secure coding practices and security architecture improvements.




Conduct forensic analysis of WAF logs and security events to identify current attack vectors, bypassed rules, and adjust mitigations accordingly.
Stay current with the latest CVEs and threat intelligence and rapidly deploy compensating WAF controls.

Foundational Expertise
Minimum 3+ years of experience in an Application Security or Penetration Testing role.
Expert-level knowledge of HTTP/HTTPS protocols, TCP/IP, and TLS/SSL.
Proficiency with security tools such as Burp Suite Professional, OWASP ZAP, and various vulnerability scanners.
Solid understanding of common attack techniques (SQLi, XSS, SSRF, Deserialization, XXE, Command Injection).
Solid understanding of API security mechanisms and vulnerabilities (e.g., broken object level authorization - BOLA, excessive data exposure).

Desirable (Nice-to-Have) Skills
Industry certifications such as OSCP, CEH, CISSP, GWEB, or relevant cloud certifications.
-

📌 Security Engineer Bhandup
🏢 Pagentra Infosec
📍 Bhandup