Security Engineer – Source code Review, VAPT

• Perform Static Application Security Testing (SAST) on web and mobile application source code
• Identify and analyze vulnerabilities such as OWASP Top 10, CWE, and secure coding flaws
• Triage and validate SAST findings and eliminate false positives
• Work closely with developers to explain vulnerabilities and recommend remediation
• Integrate security testing tools into CI/CD pipelines.
• Conduct Web Application Vulnerability Assessment and Penetration Testing
• Identify vulnerabilities including SQL Injection, XSS, CSRF, SSRF, authentication and authorization issues
• Perform both automated and manual penetration testing
• Validate vulnerabilities and assess business risk
• Prepare detailed VAPT reports with proof of concept and remediation steps
• Perform re-testing after fixes.
• Conduct Mobile Application VAPT for Android and iOS applications
• Perform static and dynamic analysis of mobile applications
• Identify issues such as insecure storage, improper platform usage, insecure
• communication, and weak cryptography
• Use reverse engineering and runtime analysis techniques when required
• Prepare detailed VAPT security assessment reports

• Support Governance, Risk, and Compliance (GRC) activities
• Ensure compliance with CERT-In directives, incident reporting, and log retention requirements
• Implement and monitor controls as per the DPDP Act (Digital Personal Data Protection Act)
• Assist in internal and external security audits
• Perform risk assessments, gap analysis, and compliance tracking
• Maintain security policies, procedures, SOPs, and audit documentation
• Support ISO 27001, SOC 2, and other regulatory or customer audits

PREFERRED CERTIFICATIONS:

• CEH (Certified Ethical Hacker)

• OSCP / GWAPT / eMAPT / GMOB (any VAPT-related certification)

• CSSLP (for application security)

ADDITIONAL REQUIREMENTS:

• Ability to work independently and in a team environment

• Strong attention to detail and security mindset

• Willingness to learn and adapt to new security threats and regulations

REQUIRED SKILLS & KNOWLEDGE:

• Strong understanding of application security and secure SDLC

• In-depth knowledge of OWASP Top 10 (Web & Mobile)

• Hands-on experience with SAST, Web VAPT, and Mobile VAPT tools

• Knowledge of CERT-In guidelines and Indian cyber security regulations

• Strong understanding of DPDP Act, data privacy, and data protection principles

• Familiarity with ISO 27001, risk management, and audit processes

• Good documentation and reporting skills

• Strong analytical and communication skills

• SAST Tools: Checkmarx, Fortify, Veracode, SonarQube (or similar)
• Web VAPT Tools: Burp Suite, OWASP ZAP, Nikto, Acunetix
• Mobile Security Tools: MobSF, Drozer, Frida, Burp Suite
• Security Tools: SIEM (Splunk/ELK), WAF, EDR
• CI/CD and DevSecOps tools (preferred)