Role & responsibilities

- Perform end-to-end security assessment of web applications before production launch
- Review application architecture from a cybersecurity perspective
- Conduct web application penetration testing
- Review authentication, authorization, user roles, session management, and password-security controls
- Identify vulnerabilities based on OWASP Top 10, OWASP WSTG, and related application-security standards
- Perform secure code reviews and identify coding-related security vulnerabilities
- Review database security, access controls, credentials, encryption, and SQL-related vulnerabilities
- Review web server, cloud/server configuration, TLS/SSL, firewall, security headers, and production configuration
- Review third-party integrations and APIs from a security perspective, where applicable
- Perform vulnerability scanning and automated security testing
- Review third-party libraries and application dependencies for known vulnerabilities
- Evaluate file uploads, input validation, error handling, logging, audit trails, and sensitive-data handling
- Identify business-logic vulnerabilities and privilege-escalation risks
- Provide detailed remediation recommendations to the development team
- Retest the application after fixes are implemented
- Provide a final security assessment / residual-risk report before production launch

Preferred candidate profile

- 5+ years of overall cybersecurity experience
- Minimum 3+ years specifically in web application security and penetration testing
- Experience working with financial services, mortgage, lending, fintech,



or similar applications is preferred

Required Technical Skills:

- Robust Web Application Security knowledge
- OWASP Top 10
- OWASP Web Security Testing Guide (WSTG)
- OWASP Application Security Verification Standard (ASVS)
- Web Application Penetration Testing
- Secure Code Review
- Authentication and Authorization Testing
- SQL Injection and Database Security
- Cross-Site Scripting (XSS)
- CSRF, SSRF, Session Management, and Access Control Testing
- SAST, DAST, and Software Composition Analysis (SCA)
- Vulnerability Assessment
- Burp Suite / OWASP ZAP or equivalent security-testing tools
- Server and Infrastructure Security
- Cloud Security knowledge
- TLS/SSL and security-header configuration
- Secrets and credential management
- Security Logging and Monitoring
- Secure Software Development Lifecycle (Secure SDLC)

Preferred Certifications: Certifications are preferred but hands-on application-security experience is more important.

Relevant certifications may include

- OSCP
- OSWE
- GIAC GWAPT / GWEB
- CISSP
- CEH or equivalent security certifications

Expected Deliverables:

1. Application Security Assessment Report
2. Penetration Testing Report
3. List of vulnerabilities categorized as Critical / High / Medium / Low
4. Evidence and affected areas for each vulnerability
5. Recommended remediation for each issue
6. Security configuration recommendations
7. Retesting of identified vulnerabilities after remediation
8. Final pre-production security assessment / residual-risk report

📌 Senior Application Security Engineer / Cybersecurity Consultant (Bengaluru)
🏢 Stellar Innovations
📍 Bengaluru