Sr Security Consultant – Web, Mobile, API & SCR

TalaKunchi Networks Pvt Ltd; Mumbai; On-site; INR 1,100,000 - 1,650,000; Full time

Job summary

TalaKunchi Networks Pvt Ltd is seeking an experienced Application Security Tester with 3–6 years of hands‑on experience in Web, Mobile, API security testing and SCR. Experience in BFSI, UPI/payments and security compliance will be preferred.

The role involves conducting security testing across web, mobile and API surfaces, performing secure code reviews, and supporting audit processes. You will coordinate with cross‑functional teams and mentor junior testers as needed.

Qualifications

• 3–6 years hands-on Application Security / VAPT experience.
• Strong Web, API and Mobile Security Testing.
• Hands-on Secure Code Review experience.
• Strong OWASP Top 10 knowledge and security fundamentals.
• Understanding of JWT, OAuth and related auth vulnerabilities.
• Proficient with Burp Suite, Postman, MobSF and OWASP ZAP.

Responsibilities

• Perform Web Application Security Testing based on OWASP Top 10 and industry standards.
• Conduct Mobile App Security Testing for Android/iOS.
• Perform API Security Testing using Burp Suite, Postman and ZAP.
• Conduct Secure Code Review and identify insecure coding practices.
• Identify vulnerabilities in authentication, authorization, injections and data handling.
• Prepare VAPT reports with evidence, impact and remediation guidance.
• Coordinate with development teams and client stakeholders for remediation.
• Support PCI‑DSS audits and security compliance efforts.

Skills

Web Security Testing

API Security Testing

Mobile Security Testing

Secure Code Review

OWASP Top 10

JWT/OAuth knowledge

Team coordination

Audit/report writing

Education

Bachelor's degree in CS/IT/Cybersecurity

Tools

Burp Suite

Postman

OWASP ZAP

MobSF

Frida/Objection

Job description

Role Overview

We are looking for an experienced Application Security Tester with 3–6 years of hands‑on experience in Web, Mobile, API Security Testing and Secure Code Review (SCR). Experience in BFSI, UPI/payment applications and security compliance will be preferred. The candidate should have strong technical skills along with exposure to team coordination, client interaction and audit support.

Key Responsibilities

• Perform Web Application Security Testing based on OWASP Top 10 and industry-standard methodologies.
• Conduct Mobile Application Security Testing for Android/iOS.
• Perform API Security Testing using Burp Suite, Postman, OWASP ZAP, etc.
• Conduct Secure Code Review (SCR) and identify insecure coding practices.
• Identify and validate vulnerabilities related to authentication, authorization, access control, injection, session management, sensitive data, business logic and API security.
• Perform vulnerability retesting and remediation validation.
• Prepare detailed VAPT/security assessment reports with evidence, impact and remediation recommendations.
• Perform/support security testing of UPI/payment applications, including API security, transaction flows, authentication, authorization and business logic.
• Support PCI‑DSS and other security audits with VAPT reports, evidence, remediation and retest documentation.
• Coordinate with development/application teams for vulnerability remediation and closure.
• Handle client queries and participate in security review meetings.

Team Handling & Coordination

• Coordinate day‑to‑day activities of junior security testers.
• Allocate testing tasks and track assessment deliverables and timelines.
• Review vulnerability findings and reports for quality and technical accuracy.
• Mentor junior team members on application security testing and vulnerability validation.
• Coordinate with project managers, developers, application owners and client stakeholders.
• Support multiple security assessments and track remediation/closure.

Audit & Compliance Support

• Support PCI‑DSS audits/assessments and client security compliance requirements.
• Prepare audit evidence including VAPT reports, scope, methodology, findings, remediation and retest results.
• Coordinate with auditors and stakeholders for security testing‑related queries.
• Maintain assessment documentation and evidence for audit readiness.

Required Skills

• 3–6 years of hands‑on Application Security / VAPT experience.
• Strong experience in Web, API and Mobile Security Testing.
• Hands‑on experience in Secure Code Review.
• Strong knowledge of OWASP Top 10 and application security fundamentals.
• Understanding of JWT, OAuth, API authentication/authorization and business logic vulnerabilities.
• Hands‑on experience with Burp Suite, Postman, MobSF and OWASP ZAP.
• Exposure to Frida / Objection is an advantage.
• BFSI, UPI/payment application and PCI‑DSS exposure preferred.
• Good technical report writing, communication and stakeholder management skills.
• Team coordination/mentoring experience preferred.

Certifications – Preferred

• eWPT / eMAPT
• CEH
• OSCP / OSWE
• CREST or equivalent

Practical Hands‑on Experience Will Be Preferred Over Certification Alone.

Qualification

• Bachelor's degree in Computer Science / IT / Cybersecurity or equivalent.
• Strong analytical, communication and documentation skills.
• Ability to work in a structured, compliance‑driven BFSI environment.