Application Security Engineer (VAPT)

BlueBox Infosoft Pvt. Ltd.; Vadodara; On-site; INR 600,000 - 900,000; Full time

Benefits offered by this job

Performance-based incentives

Paid leave and holidays

Job summary

BlueBox Infosoft Pvt. Ltd. in Vadodara is seeking an application security professional to conduct VAPT on web applications and APIs, identify vulnerabilities in authentication, sessions and access control, and provide actionable fix recommendations.

You will review source code, work with developers to remediate issues, and stay updated on the latest threats and testing techniques. Immediate joiners preferred; on-site work in Vadodara is required.

Qualifications

• 2+ years in Application Security, VAPT or Penetration Testing.
• Strong knowledge of OWASP Top 10 and API security.
• Hands-on experience with Burp Suite, OWASP ZAP, Postman, Nmap or similar tools.
• Good understanding of HTTP/HTTPS, authentication, authorization, APIs and SQL.
• Able to read code and understand how an application is built.
• Strong analytical mindset, able to think like an attacker.
• Knowledge of .NET / C# or another web stack is a plus.
• CEH, eJPT or OSCP is a plus but not required.
• Immediate joiners or notice period up to 30 days preferred.
• Willing to work on-site in Vadodara.

Responsibilities

• Perform VAPT on web applications and APIs
• Find and prove vulnerabilities in authentication, authorization, sessions, access control and business logic
• Detect SQL Injection, XSS, CSRF, IDOR/BOLA, insecure APIs, data exposure and misconfigurations
• Find logic flaws that automated scanners miss
• Review source code and flag insecure coding practices
• Write clear reports with impact, evidence, reproduction steps and fix recommendations
• Work with developers to fix issues, then retest
• Keep up with new application-security threats and techniques

Skills

OWASP Top 10 knowledge

Tools

Burp Suite

OWASP ZAP

Postman

Nmap

Job description

Role & responsibilities

• Perform VAPT on web applications and APIs
• Find and prove vulnerabilities in authentication, authorization, sessions, access control and business logic
• Detect SQL Injection, XSS, CSRF, IDOR/BOLA, insecure APIs, data exposure and misconfigurations
• Find logic flaws that automated scanners miss
• Review source code and flag insecure coding practices
• Write clear reports with impact, evidence, reproduction steps and fix recommendations
• Work with developers to fix issues, then retest
• Keep up with new application-security threats and techniques

Preferred candidate profile

• 2+ years in Application Security, VAPT or Penetration Testing
• Strong knowledge of OWASP Top 10 and API security
• Hands-on experience with Burp Suite, OWASP ZAP, Postman, Nmap or similar tools
• Good understanding of HTTP/HTTPS, authentication, authorization, APIs and SQL
• Able to read code and understand how an application is built
• Strong analytical mindset, able to think like an attacker
• Knowledge of .NET / C# or another web stack is a plus
• CEH, eJPT or OSCP is a plus but not required
• Immediate joiners or notice period up to 30 days preferred
• Willing to work on-site in Vadodara

Perks and benefits

• Performance-based incentives
• Paid leave and holidays