Application Security Consultant (SAST & DAST)

Alignity; Hyderabad; On-site; INR 1,200,000 - 2,400,000; Full time

Job summary

Deloitte in India is seeking an Application Security Consultant specializing in SAST and DAST to lead security testing across diverse applications. You will configure scans, triage findings, and collaborate with DevOps to embed security in CI/CD. Strong scripting and communication skills are essential.

Experience in mentoring juniors, knowledge of OWASP Top 10, and familiarity with Azure/AWS security is preferred. This is a hands-on role offering growth in a leading advisory firm.

Qualifications

• Hands-on experience in application security with SAST/DAST.
• Familiarity with OWASP Top 10 and remediation strategies.

Responsibilities

• Develop and implement SAST/DAST testing plans aligned with client security requirements.
• Configure, execute, and maintain static and dynamic scans.
• Triage vulnerabilities and provide remediation guidance to development teams.
• Collaborate with DevOps to integrate security testing in CI/CD pipelines and SDLC processes.
• Document findings, configurations, and remediation actions; mentor junior analysts.

Skills

SAST tools

DAST tools

Vulnerability triage

CI/CD security

Scripting

Communication

Tools

Checkmarx

Fortify

SonarQube

HCL AppScan

Burp Suite

Job description

Join Deloitte as an Application Security Consultant specializing in SAST and DAST to lead comprehensive security testing and vulnerability management across diverse applications.

Key responsibilities

• Develop and implement robust SAST and DAST testing plans aligned with client security requirements.
• Configure, execute, and maintain static and dynamic application security scans using industry tools.
• Triage vulnerabilities to differentiate true positives from false positives, providing clear remediation guidance to development teams.
• Collaborate with development and DevOps teams to integrate security testing within CI/CD pipelines and secure SDLC processes.
• Document security findings, scan configurations, and remediation actions while mentoring junior analysts and supporting knowledge sharing.

Required skills and experience

• 5-8 years experience in application security with hands-on expertise in SAST tools (e.g., Checkmarx, Fortify, SonarQube) and DAST tools (e.g., HCL AppScan, Burp Suite).
• Strong understanding of secure coding principles, vulnerability patterns including OWASP Top 10, and effective remediation strategies.
• Proficiency in triaging vulnerabilities, managing scan configurations, and integrating security scans in CI/CD pipelines.
• Experience in scripting (PowerShell, Python, Bash) to automate scanning tasks and generate security reports.
• Excellent communication skills to present complex security findings clearly to technical and non-technical stakeholders.

Nice to have

• Experience in a consulting or professional services environment delivering application security testing.
• Familiarity with cloud security platforms like Azure, AWS, or GCP and associated native security tools.
• Knowledge of software composition analysis (SCA) and secret scanning tools.
• Exposure to penetration testing, automated security testing frameworks, and secure SDLC methodologies.
• Understanding of compliance frameworks such as HIPAA or PCI-DSS and agile delivery practices.