Application Security Engineer
- ti Steps
- 2 - 7 years
- Chennai
- 21 days ago
- Email to a friend
- Report this job
Job Description
Job Summary
We are seeking an experienced Application Security Engineer to strengthen the security of enterprise applications across the software development lifecycle (SDLC). The role involves identifying vulnerabilities in web applications, APIs, and services, performing secure code reviews, supporting DevSecOps practices, and working closely with development teams to remediate security issues.
The ideal candidate will have hands-on experience in application security testing, secure coding practices, threat modeling, and security tool integration within CI/CD pipelines.
Key Responsibilities
Application Security Testing
- Perform security assessments of web applications, APIs, and microservices.
- Conduct static and dynamic application security testing (SAST, DAST, and IAST).
- Identify and validate vulnerabilities such as injection flaws, broken authentication, insecure deserialization, and access control issues.
- Perform manual testing aligned with OWASP Top 10 and OWASP API Security Top 10.
Secure Code Review & Development Support
- Conduct secure code reviews across multiple programming languages (e.g., Java, .NET, Python, JavaScript).
- Provide remediation guidance to development teams for identified vulnerabilities.
- Define secure coding standards and best practices.
- Collaborate with developers to fix security issues early in the SDLC.
DevSecOps Integration
- Integrate security tools into CI/CD pipelines (Jenkins, GitLab CI, Azure DevOps).
- Automate security testing within build and deployment processes.
- Support Infrastructure as Code (IaC) security scanning (Terraform, CloudFormation).
- Work with DevOps teams to ensure continuous security validation.
Threat Modeling & Risk Assessment
- Perform application threat modeling and architecture security reviews.
- Identify attack surfaces and recommend mitigation strategies.
- Assess security risks in application design and architecture phases.
- Map threats to MITRE ATT&CK and OWASP frameworks.
Vulnerability Management
- Track, validate, and prioritize application security vulnerabilities.
- Work with development and QA teams to ensure timely remediation.
- Perform re-testing and validation of fixed vulnerabilities.
- Maintain vulnerability dashboards and metrics.
Security Tooling & Automation
- Configure and manage application security tools and scanners.
- Improve detection rules and reduce false positives in AppSec tools.
- Develop scripts and automation for security testing processes.
- Evaluate and adopt new AppSec tools and technologies.
Required Qualifications
- Bachelors degree in Cybersecurity, Computer Science, Information Technology, or related field.
- 36 years of experience in Application Security, Secure Development, or Penetration Testing.
- Strong understanding of web application architecture and security vulnerabilities.
- Experience working in Agile/DevOps environments.
- Knowledge of secure software development lifecycle (SSDLC).
Technical Skills
Application Security Tools
- Burp Suite Professional
- OWASP ZAP
- Checkmarx / Veracode / Fortify (SAST tools)
- DAST tools (AppScan, Acunetix)
- Snyk / Semgrep
- Dependency scanning tools (Mend, Black Duck)
Security Domains
- Web Application Security
- API Security
- Authentication & Authorization Security
- Session Management
- Input Validation & Injection Prevention
- Secure Coding Practices
Programming & Scripting
Proficiency in one or more:
- Java
- .NET
- Python
- JavaScript
- SQL
- Bash / PowerShell (preferred)
DevSecOps Tools
- Jenkins / GitLab CI / Azure DevOps
- Docker (basic understanding)
- Kubernetes security (preferred)
- Terraform security scanning (preferred)
Security Frameworks & Standards
- OWASP Top 10
- OWASP API Security Top 10
- OWASP ASVS
- NIST Cybersecurity Framework
- MITRE ATT&CK
- CIS Controls
- ISO 27001 (basic awareness)
Preferred Skills
- Experience with secure architecture reviews and threat modeling.
- Knowledge of cloud-native application security (AWS/Azure/GCP).
- Familiarity with container and microservices security.
- Experience in bug bounty or responsible disclosure programs.
- Exposure to API gateways and authentication frameworks (OAuth, JWT, SAML).
- Understanding of zero trust security principles.
Preferred Certifications
- Offensive Security Web Expert (OSWE)
- Certified Ethical Hacker (CEH)
- GIAC Web Application Penetration Tester (GWAPT)
- CompTIA Security+
- CSSLP (Certified Secure Software Lifecycle Professional)
- AWS Certified Security Specialty (optional)
- Microsoft SC-200 / SC-300 (optional)
Key Competencies
- Application Security Testing
- Secure Code Review
- DevSecOps Integration
- Vulnerability Assessment & Management
- Threat Modeling
- Problem Solving & Analytical Thinking
- Collaboration with Developers
- Security Automation
- Technical Documentation
- Communication & Stakeholder Management
Key Performance Indicators (KPIs)
- Reduction in application security vulnerabilities.
- Time taken to detect and remediate AppSec issues.
- Coverage of security testing in SDLC.
- Effectiveness of DevSecOps integration.
- Reduction in repeat vulnerabilities.
- Quality of secure coding guidance provided.
Preferred Candidate Profile
The ideal candidate is a hands-on application security professional with strong knowledge of secure coding, vulnerability analysis, and DevSecOps practices. They should be able to work closely with development teams to embed security into every phase of the software development lifecycle.
Job Classification
Industry: IT Services & ConsultingFunctional Area / Department: IT & Information SecurityRole Category: IT SecurityRole: Application Security EngineerEmployement Type: Full timeContact Details:
Company: ti StepsLocation(s): Chennai
Keyskills: Mobile Security Mobile Application Security Web Application Security Application Security Application Security Testing Code Review
ti Steps
TI Steps (Tisteps Private Limited) is an EdTech and staffing company based in Chennai, India. The company, founded in 2012, has two main divisions: an EdTech arm that builds educational technology products, and a staffing division that provides talent acquisition services. The company was formerl...
Job Listings
We are in open beta version of website, please let us know if any issues, at: info(at)indigojobs.in