Security Brigade is hiring a Security Researcher to join our application security practice. You will run hands-on web application penetration tests for enterprise customers across BFSI, fintech, healthcare, and SaaS - backed by our Lemon audit-management platform and reviewed through our L1/L2/L3 senior chain so you grow under structured supervision from day one. You will own the full lifecycle: scoping with the customer, executing the test, documenting findings with proof-of-concept evidence, walking remediation owners through fixes, and revalidating closures. The role is a strong fit for engineers two to four years into application security who want depth - and a direct path to senior research as we scale.
Responsibilities
Run web application penetration tests end-to-end on customer applications
Apply manual testing techniques alongside Burp / OWASP ZAP / custom tooling - automated scanners are a start, not a finish
Document findings with transparent proof-of-concept, business impact, and remediation guidance - written for engineering teams to act on
Walk customer engineering teams through findings; advise on fixes; revalidate closures
Contribute to internal research, methodology updates, and Lemon platform improvements
Requirements
2+ years of hands-on web application penetration testing experience
Robust working knowledge of OWASP Top 10 (web) and common business-logic flaw patterns
Proficient with Burp Suite (Pro a plus), and comfortable writing custom payloads / extensions where needed
Comfortable reading and reasoning about modern application stacks (React / Angular / Vue front-ends; Node / Django / Rails / Spring back-ends; REST + GraphQL APIs)
Excellent written English for report-quality output
Practical lab experience on Hack The Box, PortSwigger Web Security Academy, or TryHackMe a strong signal
Quick Facts
Team: Application Security
Location: Mumbai / Remote
Type: Full time
Level: Mid
Disclaimer: This job posting & location has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.