- Perform comprehensive Security Testing and Assessment activities across applications APIs cloud environments and supporting infrastructure
- Execute Dynamic Application Security Testing DAST Vulnerability Assessments and Security Validation activities using industry standard tools and methodologies
- Conduct manual and automated security testing to identify vulnerabilities related to authentication authorization session management encryption access controls and business logic flaws
- Assess applications against industry standards and frameworks such as OWASP Top 10 OWASP API Security Top 10 CWE NIST and SANS
- Identify analyze prioritize and document security vulnerabilities with detailed risk ratings business impact analysis and remediation guidance
- Perform false positive analysis vulnerability validation and retesting to verify remediation effectiveness
- Validate implementation of security controls including identity and access management multifactor authentication secrets management data protection cryptographic controls and secure communication mechanisms
- Collaborate closely with Development Architecture QA and Dev SecOps teams to promote secure coding practices and integrate security into the Software Development Life Cycle SDLC
- Perform security reviews threat assessments and risk based security evaluations for new and existing applications
- Participate in vulnerability management activities including triage tracking risk acceptance reviews and remediation validation
- Prepare detailed security assessment reports and effectively communicate findings risks and recommendations to technical and non technical stakeholders
- Conduct false positive analysis and provide remediation recommendations
- Validate authentication authorization session management encryption and access control mechanisms
Technical Requirements:
- 3 years of experience in Application Security Testing Vulnerability Assessment and Security Validation
- Robust hands on experience with DAST tools such as Burp Suite Pro HCL App Scan Acunetix Netsparker or equivalent
- Solid understanding of Web API and Cloud Security concepts
- Knowledge of OWASP Top 10 OWASP API Security Top 10 CVSS CWE and Secure SDLC practices
- Experience in vulnerability reporting risk analysis remediation validation and stakeholder communication
- Understanding of authentication protocols such as OAuth 2
- 0 OpenID Connect OIDC SAML JWT and MFA
- Experience with Cloud Security Azure AWS GCP and container security assessments
- Exposure to SAST SCA OSS Security Testing API Security Testing and Threat Modeling methodologies