DevSecOps Associate - Source Code Review Security

ESP Engineered; Maharashtra; On-site; INR 600,000 - 1,200,000; Full time

Job summary

ESP Engineered is looking for an Application Security professional based in Pune, India. The role involves performing deep manual source code reviews and identifying critical security vulnerabilities across various architectures, including web and mobile.

We seek candidates with 1-2+ years of experience in Application Security and a strong Secure SDLC and DevSecOps background. Familiarity with security tooling such as Checkmarx and Veracode is preferred.

Qualifications

• 1-2+ years of Application Security experience.
• Expertise in Manual Secure Code Review.
• Strong Secure SDLC and DevSecOps background.
• Ability to provide developer-focused remediation guidance.
• Experience reviewing enterprise-scale codebases and security architectures.

Responsibilities

• Perform deep manual source code reviews across various architectures.
• Identify and validate critical security vulnerabilities.
• Conduct Secure Architecture Reviews and Threat Modeling.

Skills

Java

Spring Boot

.NET

Python

Node.js

Go

Rust

PHP

React

Angular

Vue

Next.js

Android & iOS Security

Kubernetes

Docker

Terraform

OWASP ASVS

OWASP Testing Guide

MITRE CWE

NIST Frameworks

Tools

Checkmarx

Fortify

Veracode

Semgrep

Job description

1-2+

Onsite

Full-Time

Location: Pune No of Openings: 1

Key Responsibilities

Perform deep manual source code reviews across web, API, mobile, cloud-native, and microservices architectures.

Identify and validate critical security vulnerabilities including:

• Business Logic Vulnerabilities
• Privilege Escalation
• Cloud & Container Security Weaknesses
• AI/LLM Security Risks
• Conduct:
  • Secure Architecture Reviews
  • Threat Modeling
  • API Security Assessments
  • Cloud Security Reviews
  • Infrastructure-as-Code (IaC) Reviews
  • Secure SDLC Assessments
• Technical Expertise Required
  • Java, Spring Boot, .NET, Python, Node.js, Go, Rust, PHP
  • React, Angular, Vue, Next.js
  • Android & iOS Security
  • Kubernetes, Docker, Terraform
  • OWASP ASVS, OWASP Testing Guide, MITRE CWE, NIST Frameworks

Security Tooling Experience

• Checkmarx
• Fortify
• Veracode
• Semgrep

What We're Looking For

• 1-2+ years of Application Security experience
• Expertise in Manual Secure Code Review
• Strong Secure SDLC and DevSecOps background
• Ability to provide developer-focused remediation guidance
• Experience reviewing enterprise-scale codebases and security architectures

Preferred Certifications

If you have a passion for secure software development, offensive security, and building resilient applications at scale, we'd love to hear from you.