Application Security Consultant

Heptarc; Hyderabad; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

Heptarc in Hyderabad, India, seeks a security engineer to lead application security testing and risk assessment for complex web apps.

You will perform SAST/SCA/DAST scans, configure Veracode and AppScan pipelines, and coordinate with developers and app owners to remediate findings. Strong English communication and team collaboration are essential.

Qualifications

• Bachelor's degree required.
• Strong knowledge of OWASP Top 10 and ASVS.
• Experience with SAST/DAST/SCA scanning.
• Experience with Veracode and AppScan.
• Ability to interpret CVEs and CWEs from scanners.
• Familiarity with secret management systems.
• Proficiency in front-end and back-end tech stacks (.NET/Java/PHP/Ruby/Rails/Angular/Node.js).
• Excellent written and verbal English communication.
• Team-oriented and able to work in a fast-paced environment.

Responsibilities

• Perform SAST/SCA/DAST scans using industry vulnerability scanners.
• Configure Veracode scans on compiled binaries and coordinate with app owners.
• DAST work: crawl the target app and run dynamic scans with HCL product to identify issues.

Skills

OWASP Top 10

ASVS

SAST

DAST

SCA

Veracode

AppScan

CVE/CWE analysis

Secret management

Full stack dev

English communication

Education

Bachelor's degree

Tools

Veracode

AppScan

HCL AppScan

Job description

Job Description

• Bachelor s degree required.
• Deep familiarity with the OWASP Top 10 and other security concerns for web applications
• Deep Understanding of OWASP Application Security Verification Standards (ASVS)
• Deep understanding of SAST, DAST, SCA Scanning practices
• Experience in scanning leveraging Veracode, Appscan.or other enterprise tools.
• Understand how to interpret and assess CVEs (Common Vulnerability and Exposures) and CWEs (Common Weakness Enumeration) as found by scanning tools.
• Understanding of SAST, DAST tools and dependency scanning tools
• Experience working/integrating with secret management systems.
• Advanced knowledge of front-end and back-end web application development in at least one technology stack (.NET, Java, PHP, Ruby/Rails, Angular, Node.js, etc.)
• Track record of staying current with trends, techniques, tools, and processes that drive improvement of security posture of applications.
• Strong documentation skills
• Excellent verbal and written communication skills, with proven technical writing abilities (English language proficiency required)
• Team-oriented thinking with demonstrated ability to produce high-quality work as part of a fast-paced, dynamic team.
• Proven ability to communicate, collaborate, and present effectively with teams and individuals in different disciplines or areas.
• Technical Skills: SAST, DAST, SCA

Roles and Responsibility

• Perform SAST/SCA/DAST scans using industry vulnerability scanner
• SAST/SCA Veracode, using supplied compiled binary, configure scan platform to correct scan for both static code CWE s as well as SCA derived CVEs. Work will include coordination with app owner to ensure all branches of code are included in compiled binary file.
• DAST Work begins with crawling the target application to identify existing directory and file structure. Once identified, execute DAST scan using HCL product to identify dynamic issue only visible during code execution.