Application Security Engineer

C3iHub, IIT Kanpur; New Delhi; On-site; INR 1,400,000 - 2,600,000; Full time

Job summary

C3iHub at IIT Kanpur is seeking an Application Security Engineer with hands-on experience in both application development and cybersecurity. You will conduct VAPT for web apps, APIs, and mobile apps, review secure coding practices, and coordinate with DevOps and client teams to ensure timely remediation.

You will also evaluate Docker/Kubernetes deployments, integrate security checks into CI/CD pipelines, and deliver comprehensive security reports.

Qualifications

• Hands-on experience in VAPT for web apps, APIs and mobile apps.
• Secure coding practices and secure SDLC understanding.
• Source code reviews and secure coding implementation.
• Experience in vulnerability remediation and security assessments.

Responsibilities

• Conduct VAPT for web apps, REST APIs, and mobile apps.
• Identify vulnerabilities based on OWASP Top 10 and related APIs security lists.
• Develop and review secure web apps, backend services, and APIs.
• Perform source code reviews and implement secure coding practices.
• Assess authentication, authorization, session management, API security, and data protection.
• Evaluate deployment configurations, Docker and Kubernetes for security issues.
• Integrate security testing tools into CI/CD pipelines.
• Prepare VAPT reports and remediation plans; validate fixes.
• Collaborate with development, DevOps, and infrastructure teams to improve security.

Skills

Communication skills

Problem-solving

Client handling

Education

Bachelor's or master's degree in Computer Science/IT/Cybersecurity

Tools

Burp Suite

OWASP ZAP

Postman

Docker

Kubernetes

Job description

We are looking for an Application Security Engineer with expertise in both application development and cybersecurity. The candidate should have hands-on experience in VAPT, secure coding, and security assessments of web applications, APIs, and mobile applications. The role also involves direct client communication, coordinating security activities, and ensuring timely remediation of identified vulnerabilities.

Key Responsibilities

• Conduct VAPT for web applications, REST APIs, and mobile applications.
• Identify vulnerabilities based on OWASP Top 10, OWASP API Security Top 10, and mobile application security best practices.
• Develop, maintain, and review secure web applications, backend services, and APIs.
• Perform source code reviews and implement secure coding practices.
• Assess authentication, authorization, session management, API security, and data protection mechanisms.
• Evaluate application deployment configurations, Docker containers, and Kubernetes environments for security issues.
• Integrate security testing tools and automated security checks into CI/CD pipelines.
• Prepare VAPT reports, recommend remediation measures, and validate fixes.
• Collaborate with development, DevOps, and infrastructure teams to improve application security.

Required Technical Skills

• Hands-on experience with web application and API VAPT using tools such as Burp Suite, OWASP ZAP, and Postman.
• Knowledge of OWASP Top 10, secure SDLC, secure coding, and source code analysis.
• Familiarity with SAST, DAST, dependency scanning, and CI/CD security.
• Understanding of mobile application security (Android/iOS), Docker, and Kubernetes.
• Knowledge of authentication protocols, JWT, OAuth 2.0, encryption, databases, and API security.

Client Communication & Coordination

• Communicate directly with clients to understand project requirements, discuss technical findings, and recommend appropriate security measures.
• Present VAPT results, security assessments, and project progress clearly and professionally.
• Coordinate with client-side technical teams to resolve security issues, track remediation, and conduct revalidation.
• Manage client expectations, address technical queries, and provide regular project status updates.
• Ensure timely delivery of reports, documentation, and other project deliverables.

Preferred Qualifications

• Bachelor's or master's degree in Computer Science, IT, Cybersecurity, or a related field.
• Relevant certifications such as OSCP, OSWE, BSCP, or equivalent are desirable.
• Experience in vulnerability remediation, security automation, and secure application architecture is an advantage.
• Strong communication, problem-solving, and client-handling skills.