Application Security Engineer

3i Infotech Limited; Mumbai Suburban; On-site; INR 1,000,000 - 1,800,000; Full time

Job summary

3i Infotech Limited is seeking an experienced Application Security Lead to manage the annual security testing program for production systems. You will plan and perform security testing across Web, API and mobile apps, including Android and iOS, and coordinate with internal teams and external consultants.

You will conduct SAST/DAST/IAST/ SCA activities, document findings with remediation guidance, and stay current with threats and industry best practices.

Qualifications

• 34 years of hands-on experience in Application Security Assessment and Penetration Testing.
• Strong experience in Web Application Security Testing.
• Hands-on experience in API Security Testing.
• Hands-on experience in Mobile Application Security Testing – Android and iOS.
• Good understanding of OWASP Top 10 and common application security vulnerabilities.
• Experience with Burp Suite, Kali Linux, SAST, DAST, IAST, SCA.
• Strong understanding of common vulnerabilities such as: SQL Injection, XSS, Authentication & Authorization issues, Broken Access Control, SSRF, CSRF, API Security vulnerabilities, Insecure Cryptography, Security Misconfiguration, Sensitive Data Exposure, Business Logic vulnerabilities.
• Knowledge of mobile application security concepts, including Android and iOS architecture, data storage, authentication, API communication and reverse engineering concepts.
• Ability to manually validate and exploit vulnerabilities rather than relying solely on automated scanners.
• Good understanding of vulnerability severity, risk assessment and remediation practices.

Responsibilities

• Manage and execute the annual security testing program for production systems.
• Plan, coordinate and conduct Application Security Assessments and Penetration Testing activities.
• Perform security testing of Web Applications, APIs and Mobile Applications.
• Conduct Android and iOS Mobile Application Security Testing and identify vulnerabilities.
• Perform vulnerability assessment and penetration testing using industry-standard methodologies and tools.
• Identify, validate, document and track security vulnerabilities through to remediation.
• Prepare detailed security assessment and penetration testing reports with remediation recommendations.
• Maintain and manage security testing tools, environments and infrastructure.
• Collaborate with internal teams to support testing activities and coordinate with external consultants for specialized assessments.
• Conduct SAST, DAST, IAST and SCA activities and analyze findings to identify risks.
• Perform manual testing to validate automated findings and uncover hidden issues.
• Use Burp Suite, Kali Linux and other tools for vulnerability discovery and exploitation.
• Track issues and coordinate with teams for timely remediation and re-testing.
• Stay updated with emerging threats and best practices.

Skills

App Security

Web App Security

API Security

Mobile Security

OWASP Top10

Burp Suite

Kali Linux

SAST

DAST

IAST

SCA

Vulnerability Assessment

Tools

MobSF

Frida

JADX

APKTool

Job description

Key Responsibilities

• Manage and execute the annual security testing program for existing and new production systems.
• Plan, coordinate and conduct Application Security Assessments and Penetration Testing activities.
• Perform security testing of Web Applications, APIs and Mobile Applications.
• Conduct Android and iOS Mobile Application Security Testing, including identification of application-level and platform-specific vulnerabilities.
• Perform vulnerability assessment and penetration testing using industry-standard methodologies and tools.
• Identify, validate, document and track security vulnerabilities through to remediation.
• Prepare detailed security assessment and penetration testing reports, including vulnerability impact, evidence, severity and remediation recommendations.
• Maintain and manage the security testing tools, environments and infrastructure required for application security assessments.
• Work closely with internal development, infrastructure, application and security teams to support security testing activities.
• Coordinate with external security consultants/vendors wherever required for specialized assessments.
• Conduct SAST, DAST, IAST and SCA activities and analyze findings to identify genuine security risks.
• Perform manual security testing to validate automated tool findings and identify vulnerabilities that may not be detected through automated scans.
• Use tools such as Burp Suite, Kali Linux and other application security testing tools for vulnerability discovery and exploitation.
• Track security issues and vulnerabilities and coordinate with application teams for timely remediation.
• Perform re-testing/validation of vulnerabilities after remediation to ensure effective closure.
• Stay updated with emerging application security threats, vulnerabilities, attack techniques and industry best practices.

Required Technical Skills

• 34 years of hands-on experience in Application Security Assessment and Penetration Testing.
• Strong experience in Web Application Security Testing.
• Hands-on experience in API Security Testing.
• Hands-on experience in Mobile Application Security Testing – Android and iOS.
• Good understanding of OWASP Top 10 and common application security vulnerabilities.
• Experience with:
  • Burp Suite
  • Kali Linux
  • SAST
  • DAST
  • IAST
  • SCA
• Strong understanding of common vulnerabilities such as:
  • SQL Injection
  • Cross-Site Scripting (XSS)
  • Authentication & Authorization issues
  • Broken Access Control
  • SSRF
  • CSRF
  • API Security vulnerabilities
  • Insecure Cryptography
  • Security Misconfiguration
  • Sensitive Data Exposure
  • Business Logic vulnerabilities
• Knowledge of mobile application security concepts, including Android and iOS application architecture, data storage, authentication, API communication and reverse engineering concepts.
• Ability to manually validate and exploit vulnerabilities rather than relying solely on automated scanners.
• Good understanding of vulnerability severity, risk assessment and remediation practices.

Preferred Skills

• Knowledge of OWASP ASVS, OWASP MASVS and OWASP API Security Top 10.
• Experience with mobile security testing tools such as MobSF, Frida, JADX, APKTool or equivalent.
• Understanding of Android APK and iOS IPA analysis.
• Knowledge of source-code and dependency security analysis.
• Experience working with vulnerability management/ticketing platforms.
• Security certifications such as OSCP, CEH, eJPT, GWAPT, OSWE or equivalent would be an advantage.