About the role
HTS Consulting is hiring a hands-on Application Security Lead with at least 5 years of experience across mobile, API and web application security and DevSecOps. You will test client applications, find the issues that matter and help engineering teams build security into their CI/CD pipelines. You will work with banks, fintechs, payment companies, SaaS and enterprise product teams, own engagements from scoping to retest and be the technical point of contact for client developers and security leads. What you will do Mobile application security
• Static, dynamic and manual testing of Android and iOS apps against OWASP MASVS and MASTG.
• Test root and jailbreak detection, certificate pinning, secure storage, device binding, RASP and anti-tampering using Frida, Objection and similar tools. API security
• Test REST, GraphQL and SOAP APIs against the OWASP API Security Top 10.
• Find broken object and function level authorisation, mass assignment, rate limiting gaps and business logic flaws.
• Review OAuth 2.0, OpenID Connect and JWT implementations. Web application security
• Manual and automated web application penetration testing against the OWASP Top 10 and OWASP WSTG.
• Test authentication, session management, access control, injection, SSRF, deserialisation and client-side issues. DevSecOps
• Integrate SAST, SCA, DAST, secrets, container and IaC scanning into CI/CD (GitHub Actions, GitLab CI, Azure DevOps, Jenkins).
• Define security gates, triage workflows and vulnerability SLAs with engineering teams.
• Review Docker, Kubernetes and Terraform configurations for misconfigurations.
• Run threat modelling sessions (STRIDE or similar) for new features and architectures. Delivery and leadership
• Write clear reports with risk ratings, proof of concept and practical fixes, then retest and confirm closure.




• Run secure development awareness sessions for client developers.
• Mentor junior testers and quality-check findings before they reach clients. What you bring
• 5+ years of hands-on application security experience.
• Proven work across mobile, API, web and DevSecOps.
• Strong knowledge of OWASP Top 10, OWASP API Security Top 10, MASVS, MASTG, ASVS, CWE and CVSS.
• Has set up or improved security tooling in a CI/CD pipeline.
• Scripting in Python, Bash or similar to automate testing.
• Clear communicator who can explain findings to developers and to senior management.
• Bachelor's degree in Computer Science, IT, Electronics or equivalent experience. Tools you will use
• Mobile: MobSF, Frida, Objection, Jadx, apktool, Ghidra, Drozer, adb
• API: Burp Suite Pro, Postman, OWASP ZAP, GraphQL tooling
• Web: Burp Suite Pro and extensions, sqlmap, ffuf, Nuclei
• DevSecOps: Semgrep, SonarQube, Snyk, Trivy, Checkov, Gitleaks, Docker, Kubernetes
• Cloud: security review of apps on AWS, Azure or GCP Good to have
• Certifications such as OSCP, OSWE, eMAPT, GMOB, GWAPT, Burp Suite Certified Practitioner or Certified DevSecOps Professional (CDP).
• CVEs, bug bounty findings or open-source security tools.
• Experience with BFSI or payment apps (UPI, cards, wallets) and RBI, NPCI or CERT-In security testing requirements. Why HTS Consulting
• Wide-ranging mobile, API, web and DevSecOps projects for banks, fintechs, SaaS and enterprise clients.
• Sponsored certifications (OSCP, OSWE, CDP or similar) and a training budget.
• A clear growth path to Principal Consultant or Practice Lead.
• Salary band will be discussed at the time of interview.

How to apply
Apply through LinkedIn or share

your profile
with [email protected] with the subject "Application Security Lead – ".

📌 Application Security Lead (Bengaluru)
🏢 Horizontal Thinkers
📍 Bengaluru