Role Overview

We are seeking an Application Security Engineer with hands-on experience in web application security, API security, Vulnerability Assessment and Penetration Testing (VAPT), and secure source code review. The candidate will be responsible for identifying and validating security vulnerabilities, recommending remediation measures, and collaborating with development teams to strengthen the security of enterprise applications and microservices.

Location: Noida and Mumbai

Key Responsibilities

2.1 Application Security Testing

- Conduct manual and automated VAPT of web applications, REST APIs, and application components.
- Identify vulnerabilities involving authentication, authorization, session management, access control, business logic, input validation, injection attacks, file uploads, and security misconfigurations.
- Perform security assessments aligned with the OWASP Top 10, OWASP API Security Top 10, and applicable security standards.
- Validate findings, eliminate false positives, assess business impact, and recommend appropriate remediation measures.

2.2 Secure Source Code Review

- Conduct source code reviews to identify insecure coding practices, hard-coded credentials, injection vulnerabilities, cryptographic weaknesses, and other application-level security flaws.
- Review application logic and security implementations to identify potential vulnerabilities.
- Collaborate with development teams to recommend secure coding practices and validate remediation.

2.3 Dependency and Container Security

- Perform Software Composition Analysis (SCA) and container image scanning to identify vulnerable dependencies, insecure configurations, and exposed secrets.




- Review Software Bills of Materials (SBOMs), coordinate remediation, and validate fixes through rescanning.

2.4 DevSecOps and Release Security

- Integrate security checks into CI/CD pipelines and development workflows.
- Coordinate security testing across builds and release candidates, validate remediation, and support security sign-off before production releases.

2.5 Vulnerability Management and Compliance

- Maintain vulnerability trackers, security assessment reports, remediation evidence, and risk acceptance records.
- Retest security fixes and support internal and external security audits.
- Coordinate with Development, QA, DevOps, Infrastructure, and Compliance teams to ensure timely resolution of security findings.

3. Required Skills and Experience

- 46 years of relevant experience in Application Security and VAPT.
- Hands-on experience in web application and API security testing.
- Practical experience in secure source code review and vulnerability validation.
- Strong understanding of OWASP Top 10, OWASP API Security Top 10, CWE, CVE, and secure coding principles.
- Knowledge of authentication, authorization, session management, access control, cryptography, and common web application vulnerabilities.
- Understanding of HTTP/HTTPS, REST APIs, TLS, cookies, and application security controls.
- Familiarity with SAST, DAST, SCA, SBOM, and container security concepts.
- Understanding of application architecture, microservices, databases, and common security misconfigurations.
- Ability to prepare qualified security assessment reports and provide actionable remediation guidance.
- Strong analytical, communication, documentation, and problem-solving skills.

📌 Application Security Engineer (Mumbai)
🏢 Businessnext
📍 Mumbai