Application Security Engineer

Our Opportunity

• Plan and conduct manual and automated penetration testing of web applications, APIs, and mobile applications where applicable.
  
• Evaluate authentication, authorization, session management, input validation, business logic, and sensitive data protection.
  
• Investigate vulnerability scanner results, eliminate false positives, and document clear, reproducible evidence.
  
• Prioritize findings based on severity, exploitability, and business impact, and promptly escalate critical vulnerabilities.
  
• Work with developers to address root causes, recommend practical fixes, and retest vulnerabilities before closure.
  
• Conduct targeted security code reviews, contribute to secure design reviews, and support security checks within development pipelines.
  
• Maintain a vulnerability register and prepare detailed technical reports and concise management updates.
  
• Guide developers on secure coding practices and help prevent recurring vulnerabilities.
  

• Assessment plans outlining scope, approach, and schedule.
  
• Security reports with prioritized findings, evidence, reproduction steps, and remediation recommendations.
  
• Vulnerability register tracking ownership, deadlines, and resolution status.
  
• Retesting results confirming fixes and documenting outstanding risks.
  
• Periodic management summaries and practical secure coding guidance.
  

Requirements

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related field, or equivalent practical experience.
  
• 3+ years of hands-on experience in application security or penetration testing, including web applications and APIs.
  
• Strong understanding of common application vulnerabilities and OWASP testing practices.
  
• Demonstrated ability to perform manual security testing beyond automated vulnerability scanning.
  
• Practical experience with tools such as Burp Suite, OWASP ZAP, API testing tools, and vulnerability scanners.
  
• Good understanding of HTTP/HTTPS, REST APIs, authentication, access controls, SQL, and application configurations.
  
• Ability to review code in at least one relevant programming language and write basic testing or automation scripts.
  
• Experience guiding developers through remediation and verifying implemented fixes.
  
• Ability to manage assessments independently and communicate findings clearly to technical and nontechnical stakeholders.
  
• Relevant practical certifications, such as OSCP, OSWE, or equivalent.
  
• Experience with mobile security testing, threat modeling, and secure design reviews.
  
• Familiarity with CI/CD security tools, dependency scanning, and secret detection.
  
• Experience working in on-premises or restricted environments and handling sensitive information.
  
• Certifications are an advantage; demonstrated practical competence remains the primary selection criterion.