Key Responsibilities

Penetration Testing Vulnerability Assessment

- Perform manual and automated penetration testing of Web, API, Android, and iOS applications.
- Identify, validate, and report security vulnerabilities with actionable remediation recommendations.
- Conduct security testing covering OWASP Top 10, OWASP API Security Top 10, and OWASP Mobile Top 10 / MASVS.
- Perform advanced testing across authentication, authorization, IDOR/BOLA, business logic, injection, session management, data protection, and API security.

Mobile Security Testing

- Conduct Android and iOS security testing including static and dynamic analysis, reverse engineering, SSL pinning bypass, secure storage, WebView, and runtime security testing.
- Use tools such as MobSF, Frida, Objection, and JADX/apktool.

Tooling DevSecOps

- Use Burp Suite, Nmap, and vulnerability scanners as part of routine assessment work.
- Integrate and support SAST, DAST, SCA, and vulnerability scanning within CI/CD pipelines.
- Develop scripts and automation using Python, JavaScript, Bash, or similar to improve testing efficiency.

AI-Augmented Security Testing

- Leverage AI/LLM-based tools for endpoint discovery, JavaScript analysis, test-case and payload generation, response analysis, and security reporting.

Secure SDLC Collaboration

- Participate in threat modeling, architecture reviews, and secure SDLC activities using methodologies such as STRIDE and PASTA.
- Collaborate with developers, architects, and DevOps teams to drive vulnerability remediation and improve overall application security posture.

Mentoring Continuous Improvement

- Mentor junior team members.




- Contribute to improving security testing methodologies and automation frameworks.

Required Skills Technical - Mandatory

- 3-5 years of hands-on experience in application security / penetration testing.
- Strong hands-on experience across Web, API, Android, and iOS security testing.
- Strong knowledge of OWASP Top 10, OWASP API Security Top 10, MASVS/MSTG, and common vulnerability classes.
- Hands-on expertise with Burp Suite Professional.
- Working knowledge of MobSF, Frida, Objection, JADX/apktool, or equivalent mobile security tools.
- Solid understanding of REST APIs, OAuth, JWT, HTTP/HTTPS, TLS, and authentication/authorization mechanisms.
- Experience with CI/CD and DevSecOps security practices.
- Knowledge of SAST, DAST, SCA, and vulnerability management tools.
- Strong scripting and automation skills in Python, JavaScript, or Bash.
- Exposure to AI-powered / AI-assisted security testing tools and techniques.

Behavioural

- Strong analytical and problem-solving skills.
- Clear written and verbal communication, particularly for reporting findings to technical and non-technical audiences.
- Cooperative approach across development, architecture, and operations teams.

Preferred Qualifications

- Certifications such as OSCP, CEH, or equivalent.
- Experience with cloud, container, and microservices security.
- Knowledge of threat modeling, OWASP ASVS, NIST frameworks, and SANS Top 25.

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.

📌 Sr Engineer (Security) (Bengaluru)
🏢 Comviva Technology
📍 Bengaluru