We are seeking a competent Application Security Engineer to assess and strengthen the security of our applications, APIs, and authentication systems.
The ideal candidate will have practical experience in application security testing, authorized penetration testing, vulnerability assessment, access control reviews, and session management.
The successful candidate will identify security vulnerabilities, evaluate their severity and potential business impact, and provide actionable recommendations to reduce security risks and protect sensitive information.
Key Responsibilities
Conduct security assessments of mobile applications, backend services, and APIs.
Perform authorized penetration testing within an agreed scope to identify exploitable vulnerabilities.
Assess API security, including authentication, authorization, access controls, input validation, and data exposure.
Test for common application security vulnerabilities, including broken access control, injection flaws, insecure configurations, and authentication weaknesses.
Assess whether users can access information or perform actions beyond their assigned permissions.
Evaluate the security of sensitive data transmitted between applications, APIs, and backend services.
Identify and document vulnerabilities, including their severity, likelihood, potential impact, and recommended remediation.
Rate vulnerabilities using an established methodology, such as the Common Vulnerability Scoring System (CVSS), where appropriate.
Prepare comprehensive security assessment reports for technical and management stakeholders.
Work with developers and infrastructure teams to validate findings and recommend appropriate fixes.
Conduct retesting to confirm that identified vulnerabilities have been resolved.
Maintain clear records of testing activities, findings, evidence, and remediation status.
Ensure all security testing is conducted within approved authorization, scope, and rules of engagement.
Requirements and Qualifications
Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field, or equivalent practical experience.
Demonstrable experience in application security, penetration testing, vulnerability assessment, or a related security role.
Strong understanding of web application and API security principles.
Experience testing REST APIs and mobile application security.
Knowledge of authentication, authorization, session management, and access control mechanisms.
Familiarity with common application security vulnerabilities and the OWASP Top 10.
Experience using security testing tools such as Burp Suite, OWASP ZAP, Postman, or comparable tools.
Ability to identify, reproduce, document, and assess security vulnerabilities.
Strong understanding of secure software development practices and vulnerability remediation.
Excellent analytical, technical writing, and problem-solving skills.
Preferred Skills:
Familiarity with OWASP API Security Top 10 and OWASP Mobile Application Security Verification Standard (MASVS).
Relevant certifications such as OSCP, GWAPT, CEH, or equivalent practical security testing credentials.
Experience with fintech, payment systems, financial applications, or platforms handling sensitive customer information.
Knowledge of encryption, cryptographic implementation risks, and secure token management.
Experience conducting risk-based security assessments and presenting findings to technical and non-technical stakeholders.
Key Competencies:
Strong security analysis and investigative skills
.High ethical standards and respect for confidentiality
.Attention to detail and evidence-based reporting.
Ability to prioritize vulnerabilities according to risk.