Application Security Engineer (1-3+ years of experience)

Security Lit Ltd.; Mumbai; On-site; INR 1,200,000 - 2,200,000; Full time

Job summary

Security Lit Ltd. is seeking an Application Security Engineer (L1) in Mumbai. This entry-level role requires at least 1 year of hands-on experience in application security testing across web, mobile, API, and thick client apps.

You will report vulnerabilities to senior engineers and contribute to enhancing overall security posture. The ideal candidate demonstrates strong knowledge of authentication, API security, session management, and cryptographic practices, with hands-on tooling such as Burp

Qualifications

• Hands-on experience with application security testing (1+ years).
• Proficiency in OWASP Top 10, API security, and MSTG.
• Cloud security concepts for hosting applications (AWS/Azure/GCP).

Skills

OWASP Top 10

API Security Top 10

Mobile security (OWASP MSTG)

Tools

Burp Suite Pro

Frida

Drozer

Objection

Postman

SQLMap

Job description

Application Security Engineer (1-3+ years of experience)

Compensation / year Not disclosed

About the Role

We are looking for an Application Security Engineer (L1) to join our security team. This is an entry-level position requiring at least 1 year of hands-on experience in application security testing. You will work on identifying and reporting vulnerabilities across web, mobile, API, and thick client applications while collaborating with senior engineers to improve application security.

Requirements

• In-depth expertise with OWASP Top 10, API Security Top 10, and mobile security standards (OWASP MSTG).
• Advanced knowledge of tools like Burp Suite Pro, Frida, Drozer, Objection, Postman, and SQLMap.
• Strong technical understanding of authentication, API security, session management, and cryptographic practices.
• Experience with cloud security concepts (AWS, Azure, GCP) in relation to application hosting.
• Scripting and automation skills in Python, Bash, or PowerShell.
• Excellent communication for both technical and executive-level reporting.
• Certifications (Mandatory) At least one recognized security certification such as , CEH, GPEN, or CRTP are mandatory. Preferred OSCP, OSCE, CRTO etc.