7 hours ago
Gurgaon, IndiaSenior
Responsibilities
- Perform SAST and DAST across codebases and applications under guidance.
- Conduct API security testing and review REST and GraphQL endpoints for authentication and authorization flaws.
- Support secure code reviews and identify common software vulnerabilities, including OWASP Top 10 issues.
- Work with engineering teams to triage, track, and remediate application security vulnerabilities.
- Integrate security tooling and guardrails into CI/CD pipelines and developer workflows.
- Support vulnerability management for third-party libraries, APIs, and open-source components through SCA.
- Monitor security alerts and dashboards across SIEM, EDR, and WAF systems.
- Triage alerts using defined playbooks and runbooks and support incident investigations and response.
- Participate in rotational on-call and shift coverage for security operations.
Requirements
- 0–2 years of experience or strong academic/project exposure to BurpSuite, OWASP ZAP, SIEM, EDR, and log management platforms.
- Solid understanding of REST and GraphQL API security, common vulnerabilities, and OAuth2, JWT, authentication, and authorization mechanisms.
- Understanding of mobile application security, including MASVS standards, basic Android and iOS reverse engineering, and dynamic analysis.
- Familiarity with secure coding and code review practices in languages such as Java, Python, Go, and Rust.
- Fundamentals in networking and operating systems, including TCP/IP, DNS, Linux, and Windows internals.
- Basic scripting ability in Python or Bash for automation and log analysis.
- Exposure to SIEM and log analysis concepts through coursework, labs, internships, or personal projects.
- A degree in Computer Science, Information Security, or a related field, or equivalent practical experience.
- Offensive security or AppSec certifications or practical experience such as BSCP, eJPT, CPTS, PNPT, active Bug Bounty participation, or CTF participation.
- Willingness to learn, analytical and problem-solving ability, and collaborative work with compliance, risk, and engineering teams.
- Willingness to work a rotational or on-call shift schedule.
- Preferred experience includes Snyk, SonarQube, Semgrep, Trivy, Dependabot, CrowdStrike, Sentinel, WAF solutions, AWS/GCP/Azure, CloudTrail, Security Command Center, MITRE ATT&CK, threat hunting, SOAR, containers, Kubernetes monitoring, SOC or blue-team work, and forensic investigation.
Tech Stack
AWSAzureBashCloudflareElasticsearchGoGoogle Cloud PlatformGraphQLiOSJavaKubernetesLinuxPythonRustSonarQubeSplunkWindows