Senior Application Security Specialist

Sonata Software; Pune District; In loco; INR 1.500.000 - 2.800.000; Tempo pieno

Descrizione del lavoro

Sonata Software is seeking a development-first security engineer in Pune, India. You will fix vulnerabilities directly in code, upgrade components, and build tooling to prevent recurrence.

The role involves 70% engineering and 30% security testing across web apps and APIs, with end-to-end ownership from finding to merged, tested changes. You will work on remediation, secure design, and automation, collaborating with teams to integrate SAST/DAST/SCA into CI/CD and to harden cloud and

Competenze

• 5+ years total experience in software development with security work.
• Proven record of fixing security issues in code.
• Can land a correct, tested fix in unfamiliar codebases without breaking behavior.
• Web/API development: REST/GraphQL; OAuth2/OpenID Connect/JWT; session management; databases/ORMs.
• Unit and integration testing; Git-based workflows; pull requests and code reviews.
• CI/CD pipelines with Docker and Kubernetes; IaC with Terraform or CloudFormation.
• Knowledge of web server configurations (Nginx/Apache/IIS) and TLS.
• Scripting in Python, Bash, or PowerShell to automate testing/remediation.

Mansioni

• Development and remediation: fix vulnerabilities in application code and add tests.
• Upgrade vulnerable libraries and components; manage breaking changes.
• Build internal security tooling and automation; CI/CD pipeline integration.
• Integrate SAST/DAST/SCA tooling into pipelines and tune rules.
• Address infrastructure issues: web server configs, cloud IAM, network rules, containers.
• Drive changes as pull requests; ensure fixes are merged and tested.

Conoscenze

Web/API dev

OAuth/OIDC/JWT

CI/CD pipelines

Docker

Kubernetes

Terraform/CloudFormation

Nginx/Apache/TLS

Unit testing

Integration testing

Git workflows

SAST/DAST/SCA

Python/Bash/PowerShell

Strumenti

Docker

Kubernetes

Terraform/CloudFormation

Descrizione del lavoro

Experience: 5+ years (about 70% software development, 30% security)

About the role

This is a development-first security role. About 70% of the work is engineering: you will fix vulnerabilities in application code, upgrade vulnerable components, and build the tooling and automation that keep issues from coming back. The other 30% is security testing across our web apps and APIs. You own each fix end to end, from the finding to a merged, tested change.

What you will do

Development and remediation

• Fix vulnerabilities directly in application code, in whatever language or framework the application uses, and add tests that prove the fix.
• Fix root causes, not single instances: build shared validation, output encoding, parameterized queries, and authorization checks that remove whole classes of vulnerabilities.
• Upgrade vulnerable libraries, frameworks, and third-party components, resolve breaking changes, and keep builds and tests passing.
• Build internal security tooling and automation: scanner integrations, triage and reporting scripts, and checks that catch issues before release.
• Integrate SAST, DAST, and SCA tooling such as Aikido into CI/CD pipelines, and tune the rules to cut noise.
• Fix infrastructure and configuration issues: web server and TLS settings, cloud IAM and network rules, container and Kubernetes configuration, infrastructure-as-code, and CI/CD pipeline hardening.
• Where code or infrastructure is owned by another team, raise the change yourself as a pull request and drive it to merge.

Security testing

• Test web applications and APIs for exploitable vulnerabilities.
• Review code and design for flaws in authentication, authorization, session handling, data flows, and secrets management.
• Run and tune vulnerability scans across applications, hosts, or cloud accounts, and prioritize findings by exploitability and business impact alongside CVSS.
• Retest fixes and close findings only when the vulnerability is confirmed resolved.

Reporting and communication

• Write clear findings and fix notes with reproduction steps, evidence, risk rating, and the change made.
• Agree on realistic remediation timelines with engineers, and share secure coding patterns so the same issues stop recurring.

What you bring

Experience

• 5+ years total: approx. 3.5 years building and shipping production software as a developer, and approx. 1.5+ years of hands-on security work such as VAPT, application security, or secure code review.
• A track record of fixing security issues in code.
• Able to land a correct, tested fix in an unfamiliar codebase without breaking existing behavior.
• Web and API development: REST and GraphQL services; authentication with OAuth 2.0, OpenID Connect, and JWT; session management; databases and ORMs.
• Unit and integration testing, Git-based workflows, pull requests, and code review.
• CI/CD pipelines, Docker, Kubernetes, and infrastructure-as-code such as Terraform or CloudFormation.
• Working knowledge of Nginx, Apache, IIS, and TLS configuration.
• Scripting in Python, Bash, or PowerShell to automate testing and remediation.

Communication

• Clear written findings and the ability to explain risk and trade-offs to engineers and business stakeholders.

Nice to have

• Web and API: manual testing with Burp Suite Professional; OWASP Top 10 and ASVS; injection, authentication and session flaws, access control (IDOR/BOLA), SSRF, and OAuth and JWT weaknesses.
• Secure code review: spotting vulnerable patterns in code and using SAST and SCA results to find and fix real issues.
• Built security tools, Burp extensions, or custom SAST rules (for example, Semgrep or CodeQL).
• Threat modeling and secure design review experience.
• Familiarity with compliance evidence requirements (ISO 27001, SOC 2, PCI DSS) as they relate to vulnerability remediation.

What success looks like

• Vulnerabilities reach merged, tested fixes within agreed timelines.
• Recurring vulnerability classes decline because fixes address root causes.
• The tooling and automation you build catch issues before release and cut manual triage.
• Development teams see you as a fellow engineer who ships fixes alongside them.
• Cloud misconfiguration and patch exposure windows stay short.