Application Security Engineer (Security Consultant)

Practical DevSecOps; India; Remote; INR 2,500,000 - 4,000,000; Full time

Benefits offered by this job

Competitive salary

Performance-linked bonus

Paid time off + holidays

Job summary

Practical DevSecOps seeks an experienced Application Security Engineer (Security Consultant) to lead hands‑on security testing and secure software delivery for diverse clients in India. You will perform penetration testing across web, mobile, and cloud environments, conduct threat modelling, and drive secure‑SDLC adoption with automation and tooling.

You will collaborate with engineering, QA, and product teams to deliver clear remediation guidance, create security roadmaps, and support pre‑sales

Qualifications

• 5–8 years of hands‑on security experience with penetration testing and DevSecOps.
• Proficiency with Burp Suite Pro, Metasploit, Nmap, Nessus/OpenVAS, BloodHound, Cobalt Strike.
• Strong knowledge of OWASP Top 10, CWE/SANS Top 25, MITRE ATT&CK, CVSS.
• Experience with at least one major cloud platform (AWS/Azure/GCP).
• Hands‑on experience with SAST/DAST/CI‑CD tooling and automation.

Responsibilities

• Plan and perform full-scope penetration tests across web apps, APIs, mobile apps, cloud, and internal networks.
• Conduct threat modelling and attack surface analysis for client apps and platforms.
• Perform vulnerability assessments and document remediation guidance.
• Develop PoCs and deliver actionable security findings for clients.
• Lead red team style exercises and security testing within client environments.
• Embed security into SDLC with secure‑SDLC, gates, and shift‑left practices.
• Integrate SAST/DAST/SCA and secrets scanning into CI/CD pipelines.

Skills

Penetration Testing

Threat Modelling

CI/CD Security

Automation Scripting

Cloud Security

Communication

Tools

Burp Suite Pro

Metasploit

Nmap

Nessus/OpenVAS

BloodHound

Cobalt Strike

Job description

Application Security Engineer (Security Consultant) at Practical DevSecOps

Key Responsibilities

Penetration Testing & Offensive Security

• Plan and execute full-scope penetration tests across web applications, APIs, mobile apps, cloud infrastructure, and internal networks.
• Conduct threat modelling exercises and attack surface analysis for client applications and platforms.
• Perform manual and tool-assisted vulnerability assessments, including business logic flaws, authentication bypasses, injection attacks, and privilege escalation chains.
• Develop proof-of-concept exploits and document findings with clear, actionable remediation guidance tailored to the client's tech stack.
• Simulate real-world adversarial scenarios (red team operations) targeting people, processes, and technology.

Application Security & DevSecOps

• Embed security into SDLC processes by designing and implementing Secure-SDLC frameworks, security gates, and shift-left practices.
• Integrate and tune SAST, DAST, SCA, IaC scanning, and secrets detection tools within CI/CD pipelines (GitHub Actions, GitLab CI, Jenkins, Azure DevOps).
• Define and implement API security controls, including OAuth 2.0/OIDC configurations, rate limiting, and input validation frameworks.
• Conduct secure architecture reviews, threat modelling workshops (STRIDE, PASTA, LINDDUN), and cloud security assessments (AWS, Azure, GCP).
• Develop and deliver security training and awareness sessions for engineering, QA, and product teams.

Consulting & Client Engagement

• Act as the primary security point of contact for client engagements, managing stakeholder expectations and communication throughout the project lifecycle.
• Produce high-quality deliverables including executive reports, technical findings, remediation roadmaps, and security architecture diagrams.
• Contribute to pre-sales activities, including scoping calls, proposal development, and RFP responses.
• Collaborate with internal teams to develop new service offerings, training content, and thought leadership materials.

Qualifications Required

• 5–8 years of hands‑on security experience, with demonstrable depth in both penetration testing and application security / DevSecOps.
• Proficiency with industry‑standard offensive security tools: Burp Suite Pro, Metasploit, Nmap, Nessus/OpenVAS, BloodHound, Cobalt Strike (or equivalents).
• Strong knowledge of OWASP Top 10 (Web & API), CWE/SANS Top 25, MITRE ATT&CK, and CVSS scoring.
• Experience with at least one major cloud platform (AWS, Azure, or GCP) and familiarity with cloud‑native services, IAM misconfigurations, and serverless security.
• Hands‑on experience integrating security tooling (SAST, DAST, SCA, secrets scanning) into CI/CD pipelines.
• Solid scripting skills in Python, Bash, or PowerShell for automation and custom tooling.
• Excellent written and verbal communication — able to present technical findings to both engineering teams and C‑suite executives.

Preferred

• Relevant certifications: OSCP, OSEP, BSCP, GWAPT, GWEB, CEH, CSSLP, AWS Security Specialty, or equivalent.
• Familiarity with compliance frameworks: SOC 2, ISO 27001, PCI‑DSS, NIST CSF, or CIS Controls.
• Experience with container security (Docker, Kubernetes), service mesh, and zero‑trust architecture.
• Prior consulting or client‑facing experience in a professional services environment.
• Contributions to open‑source security projects, CVE disclosures, or published security research.

What We Offer

• Competitive salary benchmarked globally
• Performance‑linked annual bonus
• Paid time off + regional public holidays

Growth & Culture

• Access to required practical DevSecOps courses