Penetration Testing Engineer / Application Security Testing Engineer

VMC Soft Technologies, Inc; Bengaluru Urban; On-site; INR 1,800,000 - 3,600,000; Full time

Job summary

VMC Soft Technologies, Inc in Bengaluru, India is seeking an experienced Application Security Testing Engineer / Penetration Testing Engineer to join our cybersecurity team. The role focuses on app security assessments, penetration testing, secure code reviews, and security automation across modern app environments.

You will conduct pen tests of web apps, APIs, and enterprise apps using Burp Suite; perform manual and automated assessments; review code in Java, JavaScript, Python; analyze

Qualifications

• 8+ years of experience in Application Security Testing or Penetration Testing.
• Strong hands-on experience with Burp Suite and web application security testing.
• Proficient in reviewing code in Java, JavaScript, Python.
• Experience integrating security controls into CI/CD pipelines.
• Solid understanding of OWASP Top 10 vulnerabilities and remediation approaches.

Responsibilities

• Conduct comprehensive penetration testing of web applications, APIs, and enterprise apps using Burp Suite.
• Perform manual and automated application security assessments to identify vulnerabilities.
• Review source code from a security perspective across Java, JavaScript, Python, and other languages.
• Analyze, validate, and remediate findings from SAST, DAST, and IAST tools, including false positives.
• Identify vulnerabilities aligned with OWASP Top 10 and provide remediation recommendations.
• Integrate and automate security testing within CI/CD pipelines for secure software delivery.
• Collaborate with development, DevOps, and infrastructure teams to improve security posture.
• Support security audits, compliance assessments, and remediation programs.
• Participate in security incident investigations and root cause analysis.
• Ensure adherence to secure SDLC practices throughout SDLC.

Skills

OWASP Top 10

CI/CD security

Secure SDLC

Vulnerability assessment

Security testing

Tools

Burp Suite

SAST/DAST/IAST tools

Job description

Hiring: Application Security Testing Engineer / Penetration Testing Engineer

Location: Bangalore (Preferred) / Other Apple Locations Across India

Experience: 8+ Years

We are looking for an experienced Application Security Testing Engineer / Penetration Testing Engineer to join our cybersecurity team. The ideal candidate will have strong expertise in application security assessments, penetration testing, secure code reviews, and security automation across modern application environments.

Key Responsibilities

• Conduct comprehensive penetration testing of web applications, APIs, and enterprise applications using industry-standard tools such as Burp Suite.
• Perform manual and automated application security assessments to identify vulnerabilities and security weaknesses.
• Review source code from a security perspective across technologies including Java, JavaScript, Python, and other programming languages.
• Analyze, validate, and remediate findings generated by SAST, DAST, and IAST security tools, including false-positive analysis.
• Identify vulnerabilities aligned with OWASP Top 10 and provide effective remediation recommendations.
• Integrate and automate security testing within CI/CD pipelines to enable secure software delivery.
• Conduct vulnerability assessments, penetration tests, and security reviews across diverse technology stacks.
• Collaborate with development, DevOps, and infrastructure teams to improve application security posture.
• Support security audits, compliance assessments, and remediation initiatives.
• Participate in security incident investigations, root cause analysis, and mitigation planning.
• Ensure adherence to secure SDLC practices throughout the software development lifecycle.

Required Skills & Experience

• 8+ years of experience in Application Security Testing, Penetration Testing, or Product Security.
• Strong hands‑on experience with Burp Suite and web application security testing.
• Deep understanding of OWASP Top 10 vulnerabilities, exploitation techniques, and remediation approaches.
• Experience with SAST, DAST, and IAST security tools and vulnerability management processes.
• Strong programming and scripting knowledge with the ability to review and audit code in Java, JavaScript, Python, and similar languages.
• Experience integrating security controls and automated testing into CI/CD pipelines.
• Solid understanding of network security, authentication mechanisms, encryption protocols, access control, and identity management.
• Experience conducting vulnerability assessments and penetration testing across enterprise applications and APIs.
• Knowledge of cloud security principles, container security, and modern application architectures.
• Familiarity with incident response, threat analysis, and security monitoring practices.
• Strong understanding of Secure SDLC and application security best practices.
• Experience supporting security audits, compliance reviews, and remediation programs.

Preferred Qualifications

• Security certifications such as OSCP, OSWE, CEH, GWAPT, CISSP, or equivalent.
• Experience securing cloud platforms such as AWS, Azure, or GCP.
• Knowledge of DevSecOps practices and security automation frameworks.
• Experience with container and Kubernetes security.