Location: Hyderabad / Pune

Experience: 9–10 Years

Shift: 1:30 PM – 10:30 PM IST

Role Type: Individual Contributor – Hands-on Technical Role

About the Role

We are looking for an experienced Senior Application Penetration Tester with robust hands-on expertise in manual security testing of web applications, APIs, AWS cloud environments and thick client/desktop applications.

The candidate will be responsible for identifying security vulnerabilities, validating Bug Bounty and Vulnerability Disclosure Program (VDP) reports, assessing risks using CVSS scoring, and providing effective remediation recommendations to development teams.

Key Responsibilities

1. Application Penetration Testing

- Perform manual security testing of web applications and REST/GraphQL APIs.
- Identify authentication, authorization, injection, business logic and access control vulnerabilities.
- Conduct security testing of applications hosted on-premises and in cloud environments.
- Identify and demonstrate exploitable vulnerabilities beyond automated scanning.

2. AWS Cloud Security Testing

- Perform penetration testing of AWS-hosted applications.
- Assess security vulnerabilities involving S3, EC2, Lambda, API Gateway, SNS and other AWS services.
- Identify cloud configuration weaknesses and application security risks.

3. Thick Client / Desktop Application Testing

- Conduct security testing of desktop and thick client applications.
- Perform reverse engineering, client-side analysis and network traffic inspection.
- Identify hardcoded credentials, insecure application logic and encryption weaknesses.

4. Bug Bounty & VDP Triage

- Review and technically validate vulnerability reports submitted by external security researchers.
- Assess the legitimacy, impact and severity of reported vulnerabilities.
- Apply CVSS scoring to classify security risks.




- Ensure fair and consistent evaluation of researcher submissions.

5. Reporting & Remediation

- Develop detailed security assessment reports.
- Create Proof of Concepts (PoCs) demonstrating identified vulnerabilities.
- Provide step-by-step reproduction instructions and remediation recommendations.
- Collaborate with application development teams to resolve security issues.

6. Collaboration & Mentoring

- Work closely with developers, product teams and security stakeholders.
- Guide junior team members and share knowledge of new attack techniques.
- Work independently while contributing to the broader security team.

Mandatory Technical Skills
- 9–10 years of experience in Application Security / Penetration Testing.
- Strong hands-on experience in manual web application and API penetration testing.
- Experience in AWS application security testing.
- Experience in thick client / desktop application penetration testing and reverse engineering.
- Strong understanding of OWASP Top 10, SANS Top 25 and common application vulnerabilities.
- Experience in Bug Bounty / Vulnerability Disclosure Program (VDP) triaging.
- Strong understanding of CVSS vulnerability scoring.
- Hands-on experience with Burp Suite, Postman, OWASP ZAP and Kali Linux.
- Strong reporting, documentation and communication skills.

Tools & Technologies
- Web/API Testing: Burp Suite, Postman, OWASP ZAP.
- Reverse Engineering: Echo Mirage, IDA Pro, CFF Explorer, dnSpy, Ghidra, dotPeek.
- Network Analysis: Wireshark, Microsoft Sysinternals.
- Cloud: AWS S3, EC2, Lambda, API Gateway, SNS.

Good to Have
- Experience in security testing of AI-based applications.
- Knowledge of AWS serverless architecture and microservices.
- AWS Cloud Practitioner or other cloud certifications.
- Security certifications such as CEH, CPENT, OSCP or OSWE.
- Previous experience in Banking / Financial Services.

📌 Senior Application Penetration Tester / Application Security Engineer (Hyderabad)
🏢 Dexian
📍 Hyderabad