Security Engineer – VAPT & Remediation

21 hours ago

Pune, IndiaSenior

Responsibilities

Identify and remediate vulnerabilities directly in application code across programming languages and frameworks.
Implement secure validation, output encoding, parameterized queries, and authorization controls to address root causes.
Upgrade vulnerable libraries, frameworks, and third-party components while resolving compatibility issues and maintaining build stability.
Develop security tools and automation for vulnerability scanning, triage, reporting, prevention, and remediation tracking.
Integrate and tune SAST, DAST, and SCA tools in CI/CD pipelines to reduce false positives.
Remediate vulnerabilities in web servers, TLS, cloud IAM, network security, containers, Kubernetes, Infrastructure as Code, and CI/CD pipelines.
Conduct VAPT and security testing of web applications and APIs, including vulnerability reproduction and remediation validation.
Perform code and design reviews covering authentication, authorization, session management, data flows, and secrets management.
Prioritize findings based on exploitability, business impact, and CVSS severity, then document them with evidence, root causes, and remediation details.
Collaborate with engineering teams, raise pull requests, drive security fixes through review and deployment, and promote secure coding practices.

5+ years of experience in software development and application security.
Strong software development experience fixing vulnerabilities across different programming languages and frameworks.
Experience with secure coding, code refactoring, debugging, root-cause analysis, dependency upgrades, and breaking-change resolution.
Experience writing automated tests to validate security fixes.
Hands-on experience testing web applications and APIs and understanding OWASP Top 10 vulnerabilities.
Experience reviewing authentication, authorization, session management, input validation, and data protection mechanisms.
Experience with SAST, DAST, and SCA tools and integrating security tools into CI/CD pipelines.
Ability to build automation scripts for vulnerability scanning, triage, reporting, and remediation tracking.
Understanding of web server security, TLS configuration, cloud IAM, network security, and CI/CD pipeline security.
Experience identifying and fixing vulnerabilities in Docker, Kubernetes, and Infrastructure as Code configurations.
Familiarity with Aikido or equivalent application security platforms, cloud security, AWS or Azure, dependency management, vulnerability management, and automated security testing is preferred.
Strong problem-solving, documentation, and communication skills with the ability to collaborate with engineering teams and drive fixes through successful deployment.