Application Security Engineer (Security Consultant)

Practical DevSecOps; Kolkata Metropolitan Area; On-site; INR 1,500,000 - 2,800,000; Full time

Benefits offered by this job

Competitive salary benchmarkedglobally

Performance‑linked annual bonus

Paid time off + regional publicolidays

Job summary

Practical DevSecOps is seeking an experienced cybersecurity professional to lead penetration testing across web apps, APIs, mobile apps, cloud infrastructure, and internal networks, with a strong focus on secure development practices. You will conduct threat modelling, perform manual and automated vulnerability assessments, develop exploit proof‑of‑concepts, and document actionable remediation.

You’ll also embed security into CI/CD pipelines, review code for security, and present findings to

Qualifications

• 5–8 years hands‑on security experience with depth in both penetration testing and application security / DevSecOps.
• Proficiency with industry‑standard offensive security tools: Burp Suite Pro, Metasploit, Nmap, Nessus/OpenVAS, BloodHound, Cobalt Strike (or equivalents).
• Strong knowledge of OWASP Top 10 (Web & API), CWE/SANS Top 25, MITRE ATT&CK, and CVSS scoring.
• Experience with at least one major cloud platform (AWS, Azure, or GCP) and familiarity with cloud‑native services, IAM misconfigurations, and serverless security.
• Hands‑on experience integrating security tooling (SAST, DAST, SCA, secrets scanning) into CI/CD pipelines.
• Solid scripting skills in Python, Bash, or PowerShell for automation and custom tooling.
• Excellent written and verbal communication — able to present technical findings to both engineering teams and C‑suite executives.

Responsibilities

• Plan and execute full-scope penetration tests across web applications, APIs, mobile apps, cloud infrastructure, and internal networks.
• Conduct threat modelling exercises and attack surface analysis for client applications and platforms.
• Perform manual and tool-assisted vulnerability assessments, including business logic flaws, authentication bypasses, injection attacks, and privilege escalation chains.
• Develop proof-of-concept exploits and document findings with clear, actionable remediation guidance tailored to the client's tech stack.
• Simulate real-world adversarial scenarios (red team operations) targeting people, processes, and technology.
• Embed security into SDLC processes by designing and implementing Secure-SDLC frameworks, security gates, and shift-left practices.
• Integrate and tune SAST, DAST, SCA, IaC scanning, and secrets detection tools within CI/CD pipelines (GitHub Actions, GitLab CI, Jenkins, Azure DevOps).
• Review source code for security vulnerabilities across languages such as Python, Java, JavaScript/TypeScript, Go, and C#.
• Define and implement API security controls, including OAuth 2.0/OIDC configurations, rate limiting, and input validation frameworks.
• Conduct secure architecture reviews, threat modelling workshops (STRIDE, PASTA, LINDDUN), and cloud security assessments (AWS, Azure, GCP).
• Develop and deliver security training and awareness sessions for engineering, QA, and product teams.

Skills

Penetration testing

Threat modelling

OWASP Top 10

CI/CD security tooling

Scripting (Python/Bash)

Communication to executives

Tools

Burp Suite Pro

Metasploit

Nessus/OpenVAS

Cobalt Strike

Cloud platform knowledge (AWS/Azure/GCP)

Job description

Key Responsibilities

• Plan and execute full-scope penetration tests across web applications, APIs, mobile apps, cloud infrastructure, and internal networks.
• Conduct threat modelling exercises and attack surface analysis for client applications and platforms.
• Perform manual and tool-assisted vulnerability assessments, including business logic flaws, authentication bypasses, injection attacks, and privilege escalation chains.
• Develop proof-of-concept exploits and document findings with clear, actionable remediation guidance tailored to the client's tech stack.
• Simulate real-world adversarial scenarios (red team operations) targeting people, processes, and technology.

Application Security & DevSecOps

• Embed security into SDLC processes by designing and implementing Secure-SDLC frameworks, security gates, and shift-left practices.
• Integrate and tune SAST, DAST, SCA, IaC scanning, and secrets detection tools within CI/CD pipelines (GitHub Actions, GitLab CI, Jenkins, Azure DevOps).
• Review source code for security vulnerabilities across languages such as Python, Java, JavaScript/TypeScript, Go, and C#.
• Define and implement API security controls, including OAuth 2.0/OIDC configurations, rate limiting, and input validation frameworks.
• Conduct secure architecture reviews, threat modelling workshops (STRIDE, PASTA, LINDDUN), and cloud security assessments (AWS, Azure, GCP).
• Develop and deliver security training and awareness sessions for engineering, QA, and product teams.

Consulting & Client Engagement

• Act as the primary security point of contact for client engagements, managing stakeholder expectations and communication throughout the project lifecycle.
• Produce high-quality deliverables including executive reports, technical findings, remediation roadmaps, and security architecture diagrams.
• Contribute to pre-sales activities, including scoping calls, proposal development, and RFP responses.
• Collaborate with internal teams to develop new service offerings, training content, and thought leadership materials.

Qualifications Required

• 5–8 years of hands‑on security experience, with demonstrable depth in both penetration testing and application security / DevSecOps.
• Proficiency with industry‑standard offensive security tools: Burp Suite Pro, Metasploit, Nmap, Nessus/OpenVAS, BloodHound, Cobalt Strike (or equivalents).
• Strong knowledge of OWASP Top 10 (Web & API), CWE/SANS Top 25, MITRE ATT&CK, and CVSS scoring.
• Experience with at least one major cloud platform (AWS, Azure, or GCP) and familiarity with cloud‑native services, IAM misconfigurations, and serverless security.
• Hands‑on experience integrating security tooling (SAST, DAST, SCA, secrets scanning) into CI/CD pipelines.
• Solid scripting skills in Python, Bash, or PowerShell for automation and custom tooling.
• Excellent written and verbal communication — able to present technical findings to both engineering teams and C‑suite executives.

Preferred

• Relevant certifications: OSCP, OSEP, BSCP, GWAPT, GWEB, CEH, CSSLP, AWS Security Specialty, or equivalent.
• Familiarity with compliance frameworks: SOC 2, ISO 27001, PCI‑DSS, NIST CSF, or CIS Controls.
• Experience with container security (Docker, Kubernetes), service mesh, and zero‑trust architecture.
• Prior consulting or client‑facing experience in a professional services environment.
• Contributions to open‑source security projects, CVE disclosures, or published security research.

What We Offer

Compensation & Benefits

• Competitive salary benchmarked globally
• Performance‑linked annual bonus
• Paid time off + regional public holidays

Growth & Culture

• Annual certification & training budget
• Access to required practical DevSecOps courses
• Speak at conferences & publish research