Sr Security Consultant – Web, Mobile, API & SCR

Keka Technologies Private Limited; Mumbai; On-site; INR 1,600,000 - 2,800,000; Full time

Job summary

Keka Technologies Private Limited is seeking an experienced Sr Security Consultant to perform Web, Mobile, API security testing and Secure Code Review (SCR). The role requires 3–6 years of hands‑on experience and involves audits, client interaction and coordination with security teams in a BFSI context.

The candidate will lead vulnerability assessments, document findings, and support PCI-DSS compliance and security audits.

Qualifications

• 3–6 years of hands‑on Application Security / VAPT experience.
• Strong experience in Web, API and Mobile Security Testing.
• Knowledge of OWASP Top 10 and app security fundamentals.
• Understanding of JWT, OAuth, API authentication/authorization and business logic vulnerabilities.
• Hands‑on experience with Burp Suite, Postman, MobSF and OWASP ZAP.
• Exposure to Frida / Objection is an advantage.
• BFSI, UPI/payment application and PCI-DSS exposure preferred.

Responsibilities

• Perform Web Application Security Testing based on OWASP Top 10 and industry standards.
• Conduct Mobile Application Security Testing for Android/iOS.
• Perform API Security Testing using Burp Suite, Postman, OWASP ZAP, etc.

Skills

Application Security

VAPT

Web Security Testing

Mobile Security Testing

API Security Testing

Secure Code Review

PCI-DSS

Education

Bachelor's degree in Computer Science / IT / Cybersecurity

Tools

Burp Suite

OWASP ZAP

MobSF

Postman

Frida / Objection

Job description

Sr Security Consultant – Web, Mobile, API & SCR

3 - 6 years

Full-Time

Role Overview

We are looking for an experienced Application Security Tester with 3–6 years of hands‑on experience in Web, Mobile, API Security Testing and Secure Code Review (SCR). Experience in BFSI, UPI/payment applications and security compliance will be preferred.

The candidate should have strong technical skills along with exposure to team coordination, client interaction and audit support.

Key Responsibilities

• Perform Web Application Security Testing based on OWASP Top 10 and industry‑standard methodologies.
• Conduct Mobile Application Security Testing for Android/iOS.
• Perform API Security Testing using Burp Suite, Postman, OWASP ZAP, etc.
• Conduct Secure Code Review (SCR) and identify insecure coding practices.
• Identify and validate vulnerabilities related to authentication, authorization, access control, injection, session management, sensitive data, business logic and API security.
• Perform vulnerability retesting and remediation validation.
• Prepare detailed VAPT/security assessment reports with evidence, impact and remediation recommendations.
• Perform/support security testing of UPI/payment applications, including API security, transaction flows, authentication, authorization and business logic.
• Support PCI-DSS and other security audits with VAPT reports, evidence, remediation and retest documentation.
• Coordinate with development/application teams for vulnerability remediation and closure.
• Handle client queries and participate in security review meetings.
• Coordinate day‑to‑day activities of junior security testers.
• Allocate testing tasks and track assessment deliverables and timelines.
• Review vulnerability findings and reports for quality and technical accuracy.
• Mentor junior team members on application security testing and vulnerability validation.
• Coordinate with project managers, developers, application owners and client stakeholders.
• Support multiple security assessments and track remediation/closure.

Audit & Compliance Support

• Support PCI-DSS audits/assessments and client security compliance requirements.
• Prepare audit evidence including VAPT reports, scope, methodology, findings, remediation and retest results.
• Coordinate with auditors and stakeholders for security testing‑related queries.
• Maintain assessment documentation and evidence for audit readiness.

Required Skills

• 3–6 years of hands‑on Application Security / VAPT experience.
• Strong experience in Web, API and Mobile Security Testing.
• Strong knowledge of OWASP Top 10 and application security fundamentals.
• Understanding of JWT, OAuth, API authentication/authorization and business logic vulnerabilities.
• Hands‑on experience with Burp Suite, Postman, MobSF and OWASP ZAP.
• Exposure to Frida / Objection is an advantage.
• BFSI, UPI/payment application and PCI-DSS exposure preferred.
• Good technical report writing, communication and stakeholder management skills.
• Team coordination/mentoring experience preferred.

Certifications – Preferred

• eWPT / eMAPT
• CEH
• OSCP / OSWE
• CREST or equivalent

Practical hands‑on experience will be preferred over certification alone.

Qualification

• Bachelor's degree in Computer Science / IT / Cybersecurity or equivalent.
• Strong analytical, communication and documentation skills.
• Ability to work in a structured, compliance‑driven BFSI environment.