Application Security Engineer

Key Responsibilities

• Conduct application security assessments, vulnerability assessments, and penetration testing of web applications, mobile applications, and APIs.
• Perform secure code reviews to identify security flaws and recommend remediation strategies.
• Identify and remediate vulnerabilities aligned with the OWASP Top 10 and OWASP API Security Top 10.
• Implement and manage security testing tools, including SAST, DAST, SCA, and secrets scanning.
• Integrate application security tools into CI/CD pipelines and DevSecOps workflows.
• Perform threat modeling and security architecture reviews for new and existing applications.
• Analyze vulnerability scan results, validate findings, eliminate false positives, and prioritize remediation based on risk.
• Collaborate with developers to resolve vulnerabilities such as SQL injection, cross-site scripting (XSS), broken access control, SSRF, and authentication flaws.
• Assess third-party libraries and open-source dependencies for known vulnerabilities.
• Establish and maintain secure coding standards and application security policies.
• Track vulnerabilities and remediation activities using security dashboards and ticketing systems.
• Support compliance initiatives and security standards such as ISO 27001, NIST, and PCI DSS, where applicable.
• Conduct security awareness sessions and provide secure coding guidance to development teams.

Required Technical Skills

• Strong understanding of web application security, API security, and common attack vectors.
• Knowledge of OWASP Top 10 and OWASP testing methodologies.
• Experience with SAST, DAST, SCA, and vulnerability management tools.
• Familiarity with tools such as Burp Suite, OWASP ZAP, SonarQube, Checkmarx, Veracode, Snyk, or similar platforms.
• Understanding of secure SDLC, DevSecOps, and CI/CD pipeline security.
• Knowledge of REST APIs, authentication, authorization, OAuth 2.0, and OpenID Connect.
• Familiarity with programming or scripting languages such as Python, Java, JavaScript, or Go.
• Understanding of cryptography, encryption, secrets management, and security configuration.
• Ability to analyze vulnerabilities, assess business impact, and recommend practical remediation.