Role & responsibilities

Required Skills

SAST & Static Code Analysis

- Static Application Security Testing (SAST) Mastery: Proven experience configuring and

running static code analysis tools (Checkmarx, Fortify, SonarQube, or equivalent) across

multiple languages and frameworks.

- Strong understanding of secure coding principles, common code-level vulnerability patterns,

and remediation techniques.

- Ability to tune SAST rulesets and scan policies to reduce noise while maintaining detection

coverage.

- Experience integrating SAST scans into build pipelines and interpreting scan results at scale.

DAST & Energetic Testing

- Dynamic Application Security Testing (DAST) — Mastery: Hands-on expertise running dynamic

scans against web applications and APIs using tools such as HCL AppScan, Burp Suite, or

OWASP ZAP.

- Working knowledge of authenticated scanning, session handling, and crawling configuration for

complex applications.

- Familiarity with API security testing, including REST and SOAP endpoints, and common API-

specific vulnerability classes.

- Experience validating dynamic findings against application behavior to confirm exploitability.

Vulnerability Management & Triage

- Strong grounding in the OWASP Top 10 and related vulnerability taxonomies (Broken Access

Control, Injection, Security Misconfiguration, Sensitive Data Exposure, and others).





- Experience with false-positive analysis and root-cause triage across SAST, DAST, and software

composition analysis (SCA) findings.

- Familiarity with Vulnerability Information Tracker (VIT) workflows: creation, validation, and

closure of defects.

- Understanding of risk-rating methodologies (CVSS or equivalent) to prioritize remediation effort.

Tooling & Integration

- Experience with software composition analysis (SCA) and secret-scanning tools (e.g.,

Checkmarx SCA, Cycode, or equivalent).

- Familiarity with CI/CD platforms (Azure DevOps, GitHub Actions, GitLab CI/CD) and embedding

security scans within pipelines.

- Exposure to cloud security posture and configuration scanning tools (e.g., Prisma Cloud) is a

plus.

- Basic scripting ability (PowerShell, Python, or Bash) to support scan automation and reporting.

Collaboration & Communication

- Ability to work effectively with cross-functional teams including developers, architects, DevOps,

and platform engineering.

- Strong problem-solving, analytical, and written/verbal communication skills.
- Ability to document scan findings, remediation guidance, and risk decisions clearly and

concisely.

- Experience in client-facing roles with demonstrated ability to present security findings to non-

technical stakeholders.

Preferred candidate profile

📌 SAST and DAST (Hyderabad)
🏢 Randstad
📍 Hyderabad