Senior Web Application Security Engineer

Qualys; Maharashtra; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

Qualys in Maharashtra is seeking a highly skilled Web Application Security Engineer to join our team. You will research and implement detections for vulnerabilities across the latest web technologies and help ensure zero false positives for our Web Application Security product.

The role emphasizes hands-on analysis, tooling, and collaboration with security researchers to stay ahead of evolving threats, including OWASP Top 10 and API security concerns.

Qualifications

• Bachelor's or Master's degree in CS/Engineering or equivalent.
• Experience with web app security and OWASP Top 10.
• Proficient with scripting languages (Python, Bash).

Responsibilities

• Research and implement detections for vulnerabilities on the latest web technologies.
• Fine-tune existing logic and payloads to detect vulnerabilities with zero false positives.
• Collaborate with security researchers to detect CVEs for the Qualys Web Application Security product.

Skills

Web application security

JavaScript programming

Regular expressions

Python scripting

Bash scripting

Selenium

Postman scripting

Metasploit/Nessus

WAF rules ModSecurity

OWASP Top 10

DAST/BlackBox tools

HTTP protocol knowledge

XML/JSON/Web services

SQL knowledge

Education

Bachelor's / Master's degree in Computer Science, Engineering, or equivalent practical experience

Tools

BURP Suite

ZAP

SQLMap

CURL

Job description

Come work at a place where innovation and teamwork come together to support the most exciting missions in the world!

Responsibilities

In this position, you will primarily be researching and implementing detections for vulnerabilities on all the latest web application technologies. You will also be expected to fine-tune existing logic and payloads to detect vulnerabilities and CVEs with zero false positives for the Qualys Web Application Security product. Efficient problem-solving and troubleshooting skills are necessary, as well as using the latest tools in the industry.

Required Skills

• 4-8 years of industry experience in web application security
• Create exploits, proof-of-concept for web application vulnerabilities
• Strong JavaScript programming skills
• Knowledge of HTTP protocol (Requests, responses, Cookies, etc.)
• Understanding of web application vulnerabilities, OWASP Top 10 in Web Applications, API, and LLMs
• Exposure to DAST/BlackBox tools
• Web application security scanning tools like BURP/ZAP, SQLMap, CURL
• Experience with network analysis tools and analysis of packet captures.
• Proficient with regular expressions.
• System administrator experience on Windows or Unix platforms.
• Strong analytical and problem-solving skills
• Passion for web security and attention to detail
• Experience with scripting languages, including Python and Bash
• Exposure to JAVA programming
• Experience with Selenium, Postman scripting
• Experience with Metasploit/Nessus exploits (especially HTTP-related )
• Experience with web application firewalls (WAF) rules, ModSecurity
• Exposure to WEB 2.0, XML/XPath, JSON, Swagger
• Database/SQL knowledge
• Experienced in the use of various scanners and open-source security tools.
• Experience in developing security-related tools/programs.
• Ability to work independently
• Published research
• Security certifications

Education

Bachelor’s / Master’s degree in Computer Science, Engineering, or equivalent practical experience