application security Professional

Security Brigade; Mumbai; On-site; INR 800,000 - 1,100,000; Full time

Benefits offered by this job

OSCP sponsorship

Mentorship from senior researchers

Active security community involvement

Job summary

Security Brigade is seeking an Associate Cybersecurity Consultant to perform hands-on security testing across web, mobile, network, and cloud environments. You will engage directly with customers, gather requirements, and contribute to threat modeling and remediation strategies.

The role targets engineers 1–3 years out of college, offering mentorship from senior researchers and structured growth within offensive security practices. Training and certification sponsorship are provided.

Qualifications

• 1-3 years of hands-on security testing experience.
• Solid understanding of OWASP Top 10 and beyond.
• Disciplined manual testing approach; automation is a start, not the finish.
• Working knowledge of at least one modern programming language.
• Strong written and spoken English for client-facing reports.
• Familiarity with React/Django and related threat models.
• Experience with Burp, Acunetix, sqlmap, Nmap, Nessus, Metasploit.

Responsibilities

• Run web and mobile application security testing, vulnerability assessments, and API security testing.
• Profile applications, model threats, and design test cases for identified threats.
• Identify and exploit vulnerabilities; document with reproducible PoCs.
• Manage engagement timelines and customer interactions across delivery.
• Produce reports with clear remediation guidance.
• Lead remediation conversations with engineering teams.
• Research emerging security topics and develop operational tools.
• Contribute to internal knowledge-sharing and platform improvements.

Skills

Security testing

Threat modeling

Manual testing

English communication

Tools

Burp Suite

Acunetix

sqlmap

Nmap

Nessus

Metasploit

Job description

Associate Cybersecurity Consultant | Security Brigade

AI Threat Era

Run hands-on application, network, and cloud security testing with structured senior review and direct customer interaction from day one.

About the Role

Security Brigade is hiring an Associate Cybersecurity Consultant to join our offensive security practice. You will run hands-on security assessments - web and mobile application testing, network vulnerability and penetration testing, source code review, configuration review, cloud security, and API security - and you will be reviewed end-to-end through our L1/L2/L3 senior chain so you grow under structured mentorship. You will work directly with customers across BFSI, fintech, healthcare, government, and tech-sector enterprises. This is a strong fit for engineers one to three years out of college who want a real path into deep offensive security.

What Youll Do

• Run web and mobile application security testing, vulnerability assessments, source code reviews, configuration reviews, cloud security, and API security testing
• Profile applications, model threats, and design test cases to target identified threats - across modern stacks
• Identify and exploit vulnerabilities in applications and networks; document with reproducible proof-of-concept
• Manage engagement timelines and customer interactions across delivery
• Produce reports against internal templates with clear remediation guidance
• Run customer-facing remediation conversations with engineering teams
• Research emerging security topics and new attack techniques - and write tools / scripts to operationalise them
• Contribute to internal knowledge-sharing and Lemon platform improvements

What Were Looking For

• 1-3 years of hands-on security testing experience (internships and serious lab work count)
• Real working understanding of common security issues, exploitation techniques, and remediation - beyond memorised OWASP Top 10
• Disciplined manual testing approach - automated scanners are a start, not a finish
• Working development knowledge of at least one modern programming language
• Strong understanding of application and network security fundamentals
• Strong written and spoken English for client-quality reports and direct customer interaction
• Familiarity with frameworks like React / Django and the threat models that come with them
• Working knowledge of the standard offensive toolchain (Burp Proxy, Acunetix, sqlmap, Nmap, Nessus, Metasploit)

What We Offer

• Sponsorship for offensive security certifications (OSCP, eWPTX, CRTO, BSCP)
• Mentorship from L2 / L3 senior researchers on every engagement
• Active community involvement (OWASP, Null, Nullcon) supported and encouraged