Application Security Testing Consultant with SAST and DAST

Cloudxtreme; Hyderabad, Pune District, Bengaluru; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

Cloudxtreme in Hyderabad, India is seeking an Application Security Tester focused on application security testing (SAST/DAST/SCA).

You will analyze vulnerabilities, validate findings, and work with developers and security teams to prioritize remediation. Experience with Checkmarx and AppScan is a plus, and familiarity with CI/CD integration is beneficial.

Qualifications

• Hands-on experience with SAST, DAST, and SCA processes.
• Ability to triage vulnerabilities and verify findings.
• Experience with security testing across web apps and APIs.
• Familiarity with OWASP Top 10 and secure coding practices.
• Experience reporting to technical and non-technical stakeholders.

Responsibilities

• Perform static application security testing (SAST) and validate findings.
• Execute dynamic application security testing (DAST) for web apps and APIs.
• Identify and triage open-source vulnerabilities (SCA).
• Perform false positive analysis and validate remediation status.
• Assess vulnerabilities by severity, impact, and priority for remediation.
• Configure and tune Checkmarx scans in enterprise environments.
• Set up AppScan assessments for web applications and APIs.
• Integrate security testing tools into CI/CD pipelines.
• Document vulnerabilities clearly for stakeholders.
• Provide remediation guidance aligned with secure coding standards.
• Communicate findings to cross-functional teams; client/enterprise delivery exposure preferred.

Skills

SAST

DAST

SCA

False Positives

Vulnerability Triaging

Security Auditing

Tools

Checkmarx

AppScan

Job description

Role & responsibilities

Application Security Testing

• SAST Advanced: Hands-on experience performing static application security testing, reviewing code-level findings, and validating scan results.

• DAST – Advanced: Experience executing dynamic application security testing for web applications and APIs and analyzing runtime vulnerabilities.

• SCA – Advanced: Experience identifying and triaging open-source and third-party component vulnerabilities.

• False Positive Analysis – Advanced: Strong ability to investigate scanner findings and accurately determine true positives versus false positives.

• Vulnerability Triaging – Advanced: Experience assessing vulnerabilities based on severity, exploitability, business impact, and remediation priority.

Security Tools & Platforms

• Checkmarx – Advanced: Hands-on experience configuring, tuning, and executing Checkmarx scans in enterprise environments.

• AppScan – Advanced: Experience setting up and running AppScan assessments for web applications and APIs.

• Familiarity with scan policy configuration, exclusions, and tuning to improve result accuracy and reduce noise.

• Understanding of integrating security testing tools into CI/CD pipelines and development workflows.

Vulnerability Management & Remediation

• Ability to document vulnerabilities clearly and concisely for technical and non-technical stakeholders.

• Experience providing remediation guidance aligned to secure coding practices and enterprise security standards.

• Strong understanding of common application vulnerabilities such as OWASP Top 10 issues, insecure dependencies, and authentication/authorization flaws.

• Ability to support revalidation and closure of remediated findings.

Collaboration & Communication

• Ability to work effectively with cross-functional teams including developers, architects, QA teams, DevOps engineers, and security stakeholders.

• Strong analytical, problem-solving, and written/verbal communication skills.

• Ability to communicate security findings, risk implications, and remediation guidance in a clear and actionable manner.

• Experience operating in client-facing or enterprise delivery environments is preferred.