Senior QA Engineer – Automation

NextGen Invent Corporation; United States; Hybrid; USD 90,000 - 130,000; Full time

Job summary

NextGen Invent Corporation in the United States is seeking a Senior QA Engineer with hands-on expertise in web UI automation, API testing, and security testing to ensure functional excellence and security resilience of modern web applications and microservices.

You will design, build, and scale automated test suites, run vulnerability scans, perform automated and manual penetration testing, and collaborate with development teams to deliver zero-defect releases.

Qualifications

• 4+ years of QA experience covering functional, regression, API, and automation testing.
• 1-2+ years of practical experience in Security Testing and Web/API Penetration Testing.
• Strong hands-on proficiency in building automation frameworks with Playwright, Cypress, Selenium, or Karate.
• Solid experience in API testing using tools such as Postman, RestAssured, Insomnia, or Karate.
• Proven proficiency with web security assessment tools such as Burp Suite, OWASP ZAP, Nmap, or SQLMap.
• In-depth understanding of OWASP Top 10 and OWASP API Security Top 10 vulnerabilities and remediation strategies.
• Strong command of SQL for data validation and backend verification.
• Solid experience with version control (Git) workflows and CI/CD integration (Jenkins, GitHub Actions, GitLab CI).

Responsibilities

• Design, build, and maintain scalable automated test suites for web applications using Playwright, Cypress, Selenium.
• Architect automated end-to-end API test suites for REST and GraphQL services, including payload validation and auth flows.
• Embed UI and API automated tests into CI/CD pipelines (GitHub Actions, GitLab CI, Jenkins) for fast feedback.
• Write complex SQL queries to validate backend data and system states.
• Conduct vulnerability assessments and web application penetration testing aligned with OWASP Top 10.
• Execute dynamic and manual penetration testing to uncover vulnerabilities like SQLi, XSS, BOLA/IDOR, CSRF, SSRF.
• Integrate automated security scanning tools into the DevSecOps workflow.
• Document findings and collaborate with development teams to triage and remediate.

Skills

Playwright

Cypress

Selenium

Karate

API testing

Security testing

Education

B.Tech / M.Tech / MCA or equivalent in Computer Science or related field

Tools

Postman

RestAssured

Insomnia

Burp Suite

OWASP ZAP

Nmap

SQLMap

GitHub Actions

Jenkins

Job description

About the job Senior QA Engineer - Automation

Experience: 4+ Years

JobLocation: WFH / Hybrid

No.of Positions: Multiple

Qualifications: B.Tech / M.Tech /MCA or equivalent in Computer Science or a related field

WorkTimings: 1:30 PM IST to 10:30 PM IST

About the Role

Weare looking for a skilled and versatile Senior QA Engineer with hands-on expertisein Web UI Automation, APITesting, and Application Security/Penetration Testing.

Inthis dual-focus role, you will be responsible forensuring both the functional excellence and security resilience of modern webapplications and microservices. You will build and scale automated test suiteswhile systematically identifying application-level security flaws, runningvulnerability scans, and performing manual and automated penetration testingacross web and API layers.

Key Responsibilities

Test Automation & API Testing

• Design, build, andmaintain scalable automated test suites for web applications using modernUI frameworks (e.g., Playwright, Cypress, Selenium).
• Architectautomated end-to-end API test suites for REST and GraphQL services(payload validation, contract testing, response times, auth token flows).
• Embed UI and APIautomated tests into CI/CD pipelines (GitHub Actions, GitLab CI,Jenkins) for continuous feedback and zero-defect releases.
• Write complex SQL queries tovalidate backend data integrity and system states.

Security & Penetration Testing

• Conductvulnerability assessments and web application penetration testing alignedwith OWASP Top 10 and OWASP API Security Top 10.
• Execute bothdynamic application security testing (DAST) and manual penetration testingto uncover vulnerabilities such as SQL injection, XSS, BrokenObject-Level Authorization (BOLA/IDOR), CSRF, and SSRF.
• Perform APIsecurity audits focusing on authentication, authorization mechanisms (OAuth 2.0,JWT, API Keys), rate limiting, and parameter tampering.
• Integrateautomated security scanning tools (e.g., OWASP ZAP, Burp Suite, Snyk) into theDevSecOps/CI-CD workflow.
• Document securityfindings, assign severity scores (CVSS), and partner directly withdevelopment teams to triage, reproduce, and verify remediation.

Collaboration & Quality Ownership

• Participateactively in Agile ceremonies (Sprint Planning, Standups,Grooming) to ensure early threat modeling and quality planning.
• Analyze systemlogs and telemetry using tools like Splunk, Datadog, or ELK to conduct rootcause analysis (RCA) on functional defects and security alerts.
• Maintain cleartechnical documentation, test strategies, and security vulnerabilityreports.

Skills, Knowledge, and Experience

Required Technical Skills

• 4+yearsof core QA experience covering functional, regression, API, and automationtesting.
• 1-2+yearsof practical experience in Security Testing andWeb/API Penetration Testing.
• Strong hands-onproficiency in building automation frameworks with tools like Playwright,Cypress, Selenium, or Karate.
• Solid experiencein API testing (functional and security) using tools such as Postman,RestAssured, Insomnia, or Karate.
• Proven proficiencywith web security assessment tools such as Burp SuiteProfessional/Community, OWASP ZAP, Nmap, or SQLmap.
• In-depthunderstanding of OWASP Top 10 and OWASP API SecurityTop 10 vulnerabilities and remediation strategies.
• Strong command of SQL (PostgreSQL,MySQL, etc.) for data validation and backend verification.
• Solid experiencewith version control (Git) workflows (branching, pullrequests, conflict resolution).
• Working knowledgeof CI/CD integration (Jenkins, GitHub Actions, GitLab CI) forrunning automated tests and automated security scans.