Application Security Engineer

Infopark; Ernakulam; On-site; INR 900,000 - 1,800,000; Full time

Job summary

Infopark is seeking an Application Security Engineer in India with 5+ years of experience to lead security testing, API risk assessment, and threat mitigation. You will apply deep knowledge of OWASP Top 10 and OWASP API Security Top 10, conduct manual and automated testing, and translate findings into prioritized remediation with SAST/DAST tools such as Snyk, SonarQube, and Qualys.

The role emphasizes reading and reviewing code in languages like Python, Java, Go, or JavaScript/TypeScript, plus

Qualifications

• 5+ years in application security, pen testing, or vulnerability research.
• Experience finding business logic and access control flaws in APIs (REST, GraphQL).
• Deep knowledge of OWASP Top 10 and OWASP API Security Top 10.
• Proficient in Burp Suite Pro and testing with custom test cases.
• Experience with SAST/DAST tools (Snyk, SonarQube, Qualys) and reducing false positives.
• Ability to read code in Python, Java, Go, or JavaScript/TypeScript.
• Knowledge of AWS security (IAM, S3, Lambda, API Gateway).
• Experience with CNAPP platforms Wiz/Qualys; turn findings into prioritized items.
• Nice to have experience with SOAR platforms and playbooks.

Skills

APIs security testing

Burp Suite Pro

OWASP Top10

AWS security

Python/Java/Go/JS

Education

Bachelors in InfoSec

Tools

Snyk

SonarQube

Qualys

Job description

Application Security Engineer

Required Qualifications:

• Bachelor's degree in Information Security, Computer Science, or a related field, or equivalent practical experience.
• 5+ years of experience in application security, penetration testing, or vulnerability research.
• Hands-on experience finding and exploiting business logic and access control flaws in APIs (REST, GraphQL).
• Deep working knowledge of the OWASP Top 10 and the OWASP API Security Top 10.
• Proficiency with manual testing tools such as Burp Suite Professional, including request manipulation and custom test cases.
• Hands-on experience operating and tuning SAST and DAST tools such as Snyk, SonarQube, and Qualys, including triaging their output and reducing false positives.
• Ability to read and review code in at least one modern language (for example, Python, Java, Go, or JavaScript/TypeScript).
• Working knowledge of AWS security, particularly IAM, S3, Lambda, and API Gateway, and how misconfigurations create application attack paths.
• Experience with Wiz and Qualys, or comparable CNAPP and vulnerability management platforms, with a record of turning automated scan or attack-testing output into validated, prioritized findings.
• Nice to have Hands-on experience any comparable SOAR platform, including building playbooks andintegrations for vulnerability management workflows/Automating.

Preferred Qualifications:

• Experience with automated or AI-assisted penetration testing and continuous DAST platforms.
• Experience writing custom rules and quality profiles in SonarQube or Snyk.
• AWS Certified Security – Specialty.
• Offensive security certifications such as OSCP, OSWE, BSCP, or GWAPT.
• Bug bounty participation or published vulnerability research