Application Security Engineer

Job Summary

• We are seeking a competent Application Security Engineer to assess and strengthen the security of our applications, APIs, and authentication systems.
• The ideal candidate will have practical experience in application security testing, authorized penetration testing, vulnerability assessment, access control reviews, and session management.
• The successful candidate will identify security vulnerabilities, evaluate their severity and potential business impact, and provide actionable recommendations to reduce security risks and protect sensitive information.

Key Responsibilities

• Conduct security assessments of mobile applications, backend services, and APIs.
• Perform authorized penetration testing within an agreed scope to identify exploitable vulnerabilities.
• Assess API security, including authentication, authorization, access controls, input validation, and data exposure.
• Review authentication mechanisms, session management, token handling, and access revocation processes.
• Test for common application security vulnerabilities, including broken access control, injection flaws, insecure configurations, and authentication weaknesses.
• Assess whether users can access information or perform actions beyond their assigned permissions.
• Evaluate the security of sensitive data transmitted between applications, APIs, and backend services.
• Identify and document vulnerabilities, including their severity, likelihood, potential impact, and recommended remediation.
• Rate vulnerabilities using an established methodology, such as the Common Vulnerability Scoring System (CVSS), where appropriate.
• Prepare comprehensive security assessment reports for technical and management stakeholders.
• Work with developers and infrastructure teams to validate findings and recommend appropriate fixes.
• Conduct retesting to confirm that identified vulnerabilities have been resolved.
• Maintain clear records of testing activities, findings, evidence, and remediation status.
• Ensure all security testing is conducted within approved authorization, scope, and rules of engagement.

Requirements and Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related field, or equivalent practical experience.
• Demonstrable experience in application security, penetration testing, vulnerability assessment, or a related security role.
• Strong understanding of web application and API security principles.
• Experience testing REST APIs and mobile application security.
• Knowledge of authentication, authorization, session management, and access control mechanisms.
• Familiarity with common application security vulnerabilities and the OWASP Top 10.
• Experience using security testing tools such as Burp Suite, OWASP ZAP, Postman, or comparable tools.
• Ability to identify, reproduce, document, and assess security vulnerabilities.
• Strong understanding of secure software development practices and vulnerability remediation.
• Excellent analytical, technical writing, and problem-solving skills.

Preferred Skills:

• Familiarity with OWASP API Security Top 10 and OWASP Mobile Application Security Verification Standard (MASVS).
• Relevant certifications such as OSCP, GWAPT, CEH, or equivalent practical security testing credentials.
• Experience with fintech, payment systems, financial applications, or platforms handling sensitive customer information.
• Knowledge of encryption, cryptographic implementation risks, and secure token management.
• Experience conducting risk-based security assessments and presenting findings to technical and non-technical stakeholders.

Key Competencies:

• Strong security analysis and investigative skills
• .High ethical standards and respect for confidentiality
• .Attention to detail and evidence-based reporting.
• Ability to prioritize vulnerabilities according to risk.
• Effective communication and collaboration.
• Practical, solution-oriented problem-solving.