Job Title: QA & Security Test Engineer – Web, Mobile, API & VAPT

Company: DCS AI Technologies

Openings: 2

Experience: 3–7 years of relevant hands-on experience

Employment Type: Full time

Location: Hisar, Gurgaon

Work Mode: Hybrid

Joining Preference: Immediate joiners and candidates with a notice period of 15 days or less will be given preference.

About the Opportunity

DCS AI Technologies is building multiple AI-powered products across creator platforms, enterprise software, developer tools, education and sports.

We are hiring two experienced testing engineers to independently plan and execute testing across our public websites, web dashboards, backend APIs and mobile applications. You will work directly with the founder and engineering team to identify defects, validate security controls and verify release readiness.

We are looking for engineers who investigate how systems can fail, understand business workflows and manually validate findings—not simply run tools and forward reports.

Hiring Focus — Two Complementary Positions

Position 1: Application Security & VAPT Engineer

Primary ownership of application security testing, API security, vulnerability assessment, manual penetration testing, source-code security review and security-fix verification.

Position 2: QA Automation & Performance Engineer

Primary ownership of functional and exploratory testing, web/mobile/API automation, regression testing, performance/load testing and cross-device compatibility.

Both engineers will collaborate on test planning, defect investigation, release verification and testing-process improvements. Candidates should have strong expertise in their primary area and working knowledge of the other.

Responsibilities Common to Both Positions

- Create practical test plans, test cases, coverage matrices and release checklists for multiple products.
- Perform manual, exploratory, functional, integration, regression, negative and end-to-end testing.
- Test websites, complex dashboards, Android/iOS applications and backend APIs.
- Validate login/signup, OTP, password reset, sessions, user roles, permissions and account recovery wherever applicable.
- Verify business workflows involving subscriptions, credits, payments, uploads, downloads, notifications and AI generation.
- Test failure scenarios, retries, duplicate requests, interrupted operations and recovery behavior.
- Report defects with clear reproduction steps,



expected versus actual behavior, severity and supporting evidence.
- Work with developers to investigate root causes, verify fixes and prevent regressions.
- Maintain traceable evidence against the exact build, commit and deployment tested.
- Help junior team members develop stronger testing practices.

Additional Responsibilities — Security & VAPT Position

- Conduct authorized web, mobile and API security assessments using OWASP testing methodologies.
- Manually test access-control failures, IDOR/BOLA, privilege escalation, cross-user data exposure and authentication/session weaknesses.
- Assess injection, XSS, CSRF, SSRF, insecure uploads, rate-limit weaknesses and business-logic vulnerabilities where applicable.
- Review source code, Git history, dependencies and build artifacts for exposed secrets and insecure implementation patterns.
- Review security headers, CSP, CORS, TLS, Cloudflare/WAF configuration, public storage and staging/preview exposure.
- Assess mobile storage, logs, permissions, deep links and network behavior.
- Validate scanner findings, explain exploitability and impact, and recommend practical fixes.

Additional Responsibilities — QA Automation & Performance Position

- Build maintainable browser, API and mobile automation suites.
- Test responsive layouts, browser compatibility, real devices, accessibility and interrupted-network behavior.
- Design and execute controlled load, stress, spike, soak and recovery tests.
- Define realistic workloads, performance thresholds, monitoring requirements and stop conditions.
- Investigate slow APIs, UI responsiveness, media-loading issues and performance regressions.
- Integrate useful automated checks into CI/CD and maintain reliable regression coverage.

Tools and Technical Skills

Applicants should have practical experience with relevant tools from the following categories. Expertise in every listed tool is not required.

- Security: Burp Suite, OWASP ZAP, Gitleaks, Semgrep, Trivy or equivalent tools.
- Web automation: Playwright, Cypress or Selenium.
- API testing:



Postman, Newman, REST clients and automated API tests.
- Mobile testing: Appium, Android Studio/ADB, Xcode tools and physical-device testing.
- Performance: k6, JMeter or Locust.
- Quality and diagnostics: Browser DevTools, Lighthouse, axe-core or equivalent.
- Engineering foundations: Git, CI/CD, HTTP, REST APIs, JSON, SQL and scripting with JavaScript/TypeScript or Python.

Required Experience and Working Approach

- Experience independently testing production-grade products and validating releases.
- Strong manual testing, analytical and debugging skills.
- Ability to distinguish confirmed vulnerabilities from false positives.
- Understanding of frontend, backend, database and third-party integration boundaries.
- Clear written communication and actionable defect reporting.
- Ability to prioritize testing across multiple active projects.
- Responsible handling of proprietary code, credentials and customer data.

Testing must use approved environments, accounts and data. Source code, secrets or customer information must not be uploaded to external tools without company authorization. Production load tests and credit-consuming AI workflows must follow agreed scope and limits.

Good to Have

- Experience testing AI/SaaS products, asynchronous jobs, webhooks, streaming responses and third-party model integrations.
- Experience with cloud hosting, CDN/WAF services, object storage and PostgreSQL.
- Relevant security or testing certifications supported by practical experience.
- Experience mentoring junior testers or establishing a testing function.

Selection Process

Shortlisted candidates may be asked to complete a practical assessment using a company-provided test environment or sample application. We will assess testing depth, quality of findings, reproducibility and communication.

How to Apply - email - [email protected]

Please include

- Updated CV.
- Total experience and primary specialization: Security/VAPT or QA Automation/Performance.
- Current and expected CTC.
- Current location.
- Notice period and earliest joining date.
- A brief description of products tested and responsibilities personally handled.
- An anonymized sample test report or automation portfolio, if available. Do not share confidential material from previous employers.

Immediate joiners and candidates available within 15 days will receive preference.

📌 QA & Security Test Engineer – Web, Mobile, API & VAPT (Gurugram)
🏢 DCS AI Technologies
📍 Gurugram