Role & responsibilities

- Perform VAPT on web applications and APIs

- Find and prove vulnerabilities in authentication, authorization, sessions, access control and business logic

- Detect SQL Injection, XSS, CSRF, IDOR/BOLA, insecure APIs, data exposure and misconfigurations

- Find logic flaws that automated scanners miss

- Review source code and flag insecure coding practices

- Write clear reports with impact, evidence, reproduction steps and fix recommendations

- Work with developers to fix issues, then retest

- Keep up with new application-security threats and techniques

Preferred candidate profile

- 2+ years in Application Security, VAPT or Penetration Testing

- Strong knowledge of OWASP Top 10 and API security

- Hands-on experience with Burp Suite, OWASP ZAP,



Postman, Nmap or similar tools

- Good understanding of HTTP/HTTPS, authentication, authorization, APIs and SQL

- Able to read code and understand how an application is built

- Robust analytical mindset, able to think like an attacker

- Knowledge of .NET / C# or another web stack is a plus

- CEH, eJPT or OSCP is a plus but not required

- Immediate joiners or notice period up to 30 days preferred

- Willing to work on-site in Vadodara

Perks and benefits

- Performance-based incentives

- Paid leave and holidays

📌 Application Security Engineer (VAPT) (Vadodara)
🏢 BlueBox Infosoft
📍 Vadodara