Application Security Engineer

Cynosure Corporate Solutions; Chennai District; On-site; INR 1,500,000 - 2,500,000; Full time

Job summary

Cynosure Corporate Solutions is seeking an Application Security Engineer to ensure software meets security standards across the lifecycle. You will integrate security tooling, perform vulnerability assessments, and guide secure coding practices for web, API, and cloud applications.

Responsibilities include conducting penetration tests, reporting findings, and supporting incident response while collaborating with product teams to strengthen the security posture of our client solutions.

Qualifications

• Strong understanding of OWASP Top 10 and SANS 25, with mitigation techniques.
• Experience with penetration testing tools such as Burp Suite, Kali Linux, Metasploit.
• Knowledge of SSDLC, threat modeling, and secure coding practices.
• Experience with REST APIs, cloud platforms, and API security concepts.

Responsibilities

• Integrate security tools and standards into the SDLC.
• Conduct vulnerability assessments and penetration testing for apps and APIs.
• Identify vulnerabilities and provide remediation guidance to stakeholders.
• Support incident response and security architecture reviews.
• Develop penetration testing plans and report findings.

Skills

OWASP Top 10 familiarity

Penetration testing

Cloud security concepts

Threat modeling

Secure coding practices

REST API security

Linux/Windows security

Tools

Kali Linux

Burp Suite

Metasploit

Nmap

Mimikatz

Bloodhound

OpenVAS

Rapid7 InsightVM

Tenable.io

Job description

Cynosure Corporate Solutions | Full time

Cynosure Corporate Solutions is a human capital services company. Our focus is to provide Executive Search, Recruitment, Training, Temporary Staffing services, Statutory Compliance's, and other HR aligned services. We understand the business goals of our clients and their need to align human resources to these goals. We are committed to provide high quality manpower in accordance to global standards and their requirements. Our candidates stand testimony to our professional competency.

We work with clients in IT/ITES, Manufacturing, Automobile, Health, Telecom, Media.

Job Description

Role Summary

The Application Security Engineer is responsible for ensuring that all developed or acquired software meets security standards while supporting rapid innovation. The role involves integrating security into the software development lifecycle, conducting security assessments, and providing expert guidance on secure coding, vulnerability management, and penetration testing.

Key Responsibilities

• Integrate security tools, best practices, and standards into the product/software development lifecycle.
  


• Conduct vulnerability assessments and penetration testing for infrastructure, web applications, APIs, mobile applications, and cloud environments.
  


• Identify, analyze, and exploit cybersecurity vulnerabilities, demonstrating attack vectors and providing remediation guidance.
  


• Support incident response and architecture review processes with application security expertise.
  


• Develop penetration testing plans, methodologies, and documentation, and report findings to stakeholders.
  


• Manage annual penetration testing activities with external vendors and internal teams.
  


• Provide manual penetration testing, security gap analysis, and application code review support.
  


• Evaluate third-party software for security compliance during vendor due diligence.
  


• Track and report on application security metrics, team performance, and security program effectiveness.
  


• Contribute to improving application frameworks, perimeter security, and overall security posture.
  

Requirements

• Strong understanding of common security vulnerabilities (OWASP Top 10, SANS 25) and mitigation techniques.
  


• Experience with penetration testing tools (e.g., Kali Linux, Burp Suite, Metasploit, Nmap NSE, Mimikatz, Bloodhound, OpenVAS, Rapid7 InsightVM, Tenable.io).
  


• Knowledge of SSDLC, threat modeling, and secure coding practices.
  


• Experience with REST APIs, SOA architecture, and API Gateway concepts.
  


• Knowledge of cloud platforms (AWS, Azure, or GCP) and pen testing for IaaS, SaaS, PaaS, and containerized environments.
  


• Familiarity with vulnerability scoring systems (CVSS, EPSS) and security frameworks (CIS Benchmark, NIST).
  


• Strong understanding of MITRE ATT&CK Framework, attack path management, red teaming, privilege escalation, lateral movement, and defense evasion techniques.
  


• Good understanding of Windows and Linux operating systems, Apache/Unix servers.
  

Additional Skills (Preferred)

• Experience in maintaining external attack surface security posture.


• Experience in application security testing (white-box, black-box, and code review).


• Certifications such as CISSP, CEH, OSCP, CSSLP are an advantage.