Crown Jewel

HDFC Bank Limited; Thane, Panvel, Navi Mumbai; On-site; INR 1,800,000 - 2,400,000; Full time

Job summary

HDFC Bank Limited is seeking a highly experienced Senior Application Security Tester to lead deep security assessments across web, API, mobile, and microservices in its fintech environment.

The role requires mentoring juniors, building robust automation, and delivering PoCs. Onsite in Navi Mumbai with a strong emphasis on leadership and cross-functional collaboration.

Qualifications

• 10+ years of hands-on security testing in fintech/banking environments.
• Mentor team and lead complex security assessments.
• Experience across web, API, mobile and microservices security.

Responsibilities

• Perform manual and automated security testing across web, mobile, API and microservices architectures.
• Conduct deep-dive reviews, static/dynamic/runtime analysis, and workflow checks.
• Test financial transaction workflows and payment gateways.
• Identify, validate, and exploit vulnerabilities to build PoCs.
• Design and implement comprehensive test strategies for web, APIs, mobile and microservices.
• Mentor juniors on testing scenarios and best practices.
• Build, scale, and maintain robust test automation frameworks.

Skills

Security testing

Mentoring juniors

Leadership

Scripting Python/JS

Cross-functional communication

Tools

Burp Suite Pro

OWASP ZAP

API testing toolkit

SAST/DAST tools

Mobile testing toolkit

Fuzz testing

Job description

We are seeking a highly experienced Senior Application Security Tester with 10+ years of deep, hands-on experience in web application and mobile security testing within fintech or banking environments. The candidate mentor the team and will be responsible for executing complex security assessments, Web, API, mobile, microservices testing across mission critical financial platforms.

Role Overview

• Requirement: Senior Application Security Tester
• Domain: Banking / Fintech
• Location: Onsite Navi Mumbai
• Role Type: Full-time

Key Responsibilities

• Perform manual and automated security testing (black box, grey box, and fuzz testing) across critical web, mobile (iOS/Android), API, and microservices architectures.
• Conduct deep-dive reviews, static/dynamic/runtime analysis, and workflow checks to uncover logic flaws, cryptography weaknesses, RASP/SSL bypass issues, and authorization failures.
• Perform in-depth testing of financial transaction workflows, payment gateways, and critical API endpoints.
• Identify, validate, and exploit vulnerabilities (including multi-stage exploit chains and privilege escalation) to build impactful Proof-of-Concepts (PoCs).
• The testing approach should include identifying and validating multi stage exploit chains, where multiple weaknesses can be combined to demonstrate realistic attack paths.
• Design and implement comprehensive test strategies for web, APIs, mobile and microservices.
• Review applications and create customised attack models and plans.
• Mentor juniors on testing scenarios, best testing practices and technical skills.
• Build, scale, and maintain robust test automation frameworks from scratch.
• Hands-on expertise in application security testing tools like Burp Suite Pro, OWASP ZAP, mobile testing toolkit, API testing toolkit, SAST/DAST tools.
• Knowledge of OWASP Top 10, CWE Top 25, OWASP API Top 10, NIST, MASVS, MASTG.
• Experience with scripting (Python/JavaScript) for automation or testing enhancement.
• Ability to map vulnerabilities to risk severity and remediation guidelines.
• Prepare detailed technical and executive reports for stakeholders.
• Strong leadership, cross-functional communication, and complex problem-solving abilities.

Mandatory Certifications any one from list

• OSCP, OSWE, eWPTX, GWAPT, CISSP, CISM, CEH, CREST-CRT.

Soft Skills

• Excellent written and verbal communication and documentation skills.
• Strong analytical and complex problem-solving abilities.
• Ability to multitask and manage multiple critical assessments in parallel.
• Stakeholder management across engineering, product, and risk functions.