OWASP Top 10: Proven ability to identify, validate, and guide developers in fixing standard web and API-centric risks (e.g., BOLA, mass assignment, injection).
Application & API Security Engineering: Deep understanding of secure coding practices (Core Java, Python), API-specific vulnerabilities (OAuth2, JWT), and the vulnerability management lifecycle.
SAST & DAST Testing: Hands-on experience configuring, running, and reviewing static code analysis using Fortify, and performing agile testing/exploitation using Burp Suite or OWASP ZAP.
OSS / SCA (Open Source Security): Experience scanning and managing third-party dependencies and open-source vulnerabilities using platforms like Sonatype or Black Duck.
API Security & Contract Testing: Strong expertise in auditing Swagger/OpenAPI specifications (OAS) and using 42Crunch for API conformance scanning and protection.