Application Security Engineer

ERM Placement Services; Mumbai, Navi Mumbai; On-site; INR 900,000 - 1,500,000; Full time

Job summary

ERM Placement Services in Mumbai seeks a security tester to perform manual and automated testing across web, mobile, and API apps.

You will identify vulnerabilities with Burp Suite and OWASP ZAP, conduct secure code reviews, and collaborate with development teams to remediate findings.

This role requires staying updated on threats and communicating results to both technical and non-technical stakeholders. Experience with threat modeling and secure design reviews is preferred.

Qualifications

• Experience in manual and automated security testing across web, mobile, and APIs.

Responsibilities

• Perform manual and automated security testing for web, mobile, and API-based applications.
• Identify and evaluate vulnerabilities with Burp Suite, OWASP ZAP, and others.
• Conduct secure code reviews to identify insecure coding practices and provide secure alternatives.
• Perform threat modeling and secure design reviews for applications and systems.
• Document detailed technical findings and communicate clearly to both technical and non-technical stakeholders.
• Collaborate with development teams to ensure timely remediation of identified vulnerabilities; suggest compensating or mitigating controls when necessary.
• Stay current with emerging security threats, vulnerabilities, and security technologies.

Skills

Security testing

Threat modeling

Secure code reviews

Stakeholder communication

Dev collaboration

Tools

Burp Suite

OWASP ZAP

Job description

Job Description:

• Perform manual and automated security testing for web, mobile, and API-based applications.
• Identify and evaluate vulnerabilities using tools such as Burp Suite, OWASP ZAP, and others.
• Conduct secure code reviews to identify insecure coding practices and provide secure alternatives.
• Perform threat modeling and secure design reviews for applications and systems.
• Document detailed technical findings and communicate clearly to both technical and non-technical stakeholders.
• Collaborate with development teams to ensure timely remediation of identified vulnerabilities; suggest compensating or mitigating controls when necessary.
• Stay current with emerging security threats, vulnerabilities, and security technologies.