Application Security Engineer

Security Lit; Mumbai; On-site; INR 900,000 - 1,200,000; Full time

Job summary

Security Lit is seeking an Application Security Engineer (L1) to join our security team. This entry-level role requires at least 1 year of hands-on experience in application security testing and the ability to identify vulnerabilities across web, mobile, API, and thick client apps.

You will collaborate with senior engineers to improve application security, document findings, and contribute to remediation guidance while staying current with evolving threats and secure coding practices.

Qualifications

• Expertise with OWASP Top 10, API Security Top 10, and OWASP MSTG.
• Familiar with Burp Suite Pro, Frida, Drozer, Objection, Postman, SQLMap.
• Knowledge of authentication, API security, session management, and cryptography.
• Cloud security concepts (AWS, Azure, GCP) for hosting applications.
• Scripting and automation in Python, Bash, or PowerShell.
• Excellent communication for technical and executive reporting.
• Certifications such as CEH, GPEN, or CRTP are mandatory; OSCP/OSCE/CRTO preferred.

Responsibilities

• Perform vulnerability assessments and penetration tests for web, mobile, API, and thick client applications.
• Identify and document application flaws, misconfigurations, and business logic issues.
• Assist in remediation guidance to developers and stakeholders.
• Prepare security testing reports and maintain accurate documentation.
• Stay updated with evolving security threats, tools, and methodologies.

Skills

OWASP Top 10

API Security Top 10

Mobile security (OWASP MSTG)

Python scripting

Bash scripting

PowerShell scripting

Education

Bachelor's degree in Computer Science, Information Security, or related field

Tools

Burp Suite Pro

Frida

Drozer

Objection

Postman

SQLMap

Job description

Job Summary

We are looking for an Application Security Engineer (L1) to join our security team. This is an entry-level position requiring at least 1 year of hands‑on experience in application security testing. You will work on identifying and reporting vulnerabilities across web, mobile, API, and thick client applications while collaborating with senior engineers to improve application security.

Responsibilities

• Perform vulnerability assessments and penetration tests for web, mobile, API, and thick client applications.
• Identify and document application flaws, misconfigurations, and business logic issues.
• Assist in providing remediation guidance to developers and stakeholders.
• Prepare security testing reports and maintain accurate documentation.
• Stay updated with evolving security threats, tools, and methodologies.

Requirements

• In-depth expertise with OWASP Top 10, API Security Top 10, and mobile security standards (OWASP MSTG).
• Advanced knowledge of tools like Burp Suite Pro, Frida, Drozer, Objection, Postman, and SQLMap.
• Strong technical understanding of authentication, API security, session management, and cryptographic practices.
• Experience with cloud security concepts (AWS, Azure, GCP) in relation to application hosting.
• Scripting and automation skills in Python, Bash, or PowerShell.
• Excellent communication for both technical and executive‑level reporting.
• Certifications (Mandatory): At least one recognized security certification such as CEH, GPEN, or CRTP are mandatory.
• Preferred OSCP, OSCE, CRTO etc.

Qualifications

• Bachelor's degree in Computer Science, Information Security, or related field.
• Hands‑on experience with Capture the Flag (CTF) challenges, bug bounty programs, or security labs.