Application Security Engineer

Basebiz; Pune District; On-site; INR 1,800,000 - 3,000,000; Full time

Job summary

Basebiz is seeking a Senior AppSec professional to lead security across our software development lifecycle. You will perform both manual and automated security assessments, implement DevSecOps practices, and guide teams on remediation of vulnerabilities across web apps and APIs.

Ideal candidates have 3+ years in SAST/ SCA/ DAST, familiarity with OWASP Top 10, and strong scripting experience. You will collaborate with agile teams in an on-site setting across major Indian tech hubs.

Qualifications

• Minimum of 3 years in SAST, SCA, DAST and DevSecOps.
• Experience with manual and automated security assessments.
• Knowledge of OWASP Top 10 and secure SDLC concepts.

Responsibilities

• Execute large-scale application security programs.
• Implement shift-left security in DevOps.
• Lead security in software development lifecycle and educate teams.
• Provide mentorship on security engagements.
• Develop automated security solutions across the organization.
• Track and drive remediation of code vulnerabilities.
• Partner with developers to deliver secure code.
• Ensure security testing becomes integral to coding processes.
• Foster relationships within Security and IT for on‑time delivery.

Skills

AppSec

DevSecOps

SAST

DAST

SCA

Threat Modelling

Education

BE/B.Tech/MCA

Tools

GitHub

GitLab

Bitbucket

Job description

Appsec

Rank Description: Senior

Hiring Location: Chennai/Bangalore/Pune/Noida

Experience range:

• Senior 3 - 5-7 Years
• Senior 2 - 4-5 Years
• Senior 1 - 3-4 Years

Job Description

• Experience with performing manual and automated SAST assessments.
• Experience with scripting / programming skills (e.g., Python, PowerShell, Java, Perl etc.), keeping up to date with the latest exploits and security trends.
• Familiarity with dynamic web application vulnerability scanning tools and services (Acunetix, HP WebInspect, HCL AppScan, BurpSuite).
• Familiarity with static code analysis tools and services (CheckMarx, Snyk, Fortify Static Code Analysis tool, Veracode, Coverity, IBM AppScan Source).
• Experience in developing a DevSecOps CI/CD pipeline using open‑source tools.
• Experience with SCM tools such as GitHub, GitLab, Bitbucket and integrating them with CI/CD pipelines via webhooks, actions, etc.
• Implementation of CI/CD phases including secret scanning, SAST, SCA, DAST, Infrastructure as Code, compliance as code, and vulnerability management.
• Optimizing pipelines for optimal results and planning maturity models for DevSecOps programs.
• Understanding of web‑based application vulnerabilities (OWASP Top 10).
• Experience with scripting / programming skills (e.g., Python, PowerShell, Java, Perl).

Mandatory keyskill (To qualify for the role, you must have)

• AppSec, DevSecOps, SAST, DAST, Source Code Review and Threat Modelling.
• BE/ B.Tech/ MCA.
• Minimum of 3 years of full‑time work experience in SAST, SCA, DAST and DevSecOps.
• Knowledge of Windows, Linux, UNIX, and other major operating systems.
• Strong Excel and PowerPoint skills.

Ideally, you will also have

• Familiarity with programming languages such as Java, JavaScript, Python and Angular.
• Strong knowledge of relevant Security Standards (OWASP) and how to apply them to the software development lifecycle in a large agile environment.
• Experience performing security analysis on web applications and APIs.
• Experience working in an Agile environment.

Key Responsibilities

• Execute large‑scale application security programs.
• Implement shift‑left security concepts and security in DevOps.
• Understand agile software development principles and integrate security practices.
• Communicate complex technical security concepts to technical and non‑technical audiences, including executives.
• Advise on software supply chain vulnerabilities and educate development teams on management strategies.
• Provide technical leadership and mentorship to junior team members on application security engagements.
• Develop automated solutions that mitigate risks across the organization.
• Support policy enforcement and vulnerability analysis using testing infrastructure (SAST, DAST, SCA, IAST, API Security).
• Ensure tools deliver value for security and development stakeholders.
• Drive integration and automation so security testing becomes an integral part of code development.
• Partner with and train developers to deliver secure code.
• Track, prioritize, and drive remediation of code vulnerabilities.
• Foster effective relationships within Security and IT teams to ensure secure, on‑time project delivery.