- Company Name
- Tata Consultancy Services
- Job Title
- Application Security Engineer
- Job Description
-
**Job title**
Application Security Engineer
**Role Summary**
Execute comprehensive penetration testing for web applications and APIs across the software development life cycle. Identify vulnerabilities, assess risk, collaborate with engineering teams for remediation, and manage findings through a vulnerability management system.
**Expectations**
- Conduct both manual and automated tests, validating findings with proof‑of‑concept exploits.
- Produce clear, actionable technical reports with severity scoring aligned to CVSS and SLA metrics.
- Track remediation progress, re‑test fixes, and close entries in the ticketing/vulnerability platform.
- Drive secure coding practices and security awareness within development teams.
**Key Responsibilities**
- Plan, scope, and execute web application and API penetration tests (pre‑release and production).
- Perform threat modeling, recon, and attack surface mapping to prioritize test coverage.
- Identify and validate authentication/authorization flaws, injection, XSS, SSRF, deserialization, IDOR, insecure direct object references, logic errors, misconfigurations, and data exposure.
- Test REST, GraphQL, and gRPC APIs for input validation, rate limiting, BOLA, schema/serialization issues.
- Use automated scanners and manual exploitation, confirm impact, reproducibility, and exploit chains.
- Prepare detailed technical reports (PoCs, severity ratings, affected components, business impact).
- Provide code‑level remediation guidance and secure patterns.
- Log findings in the vulnerability tracking system (e.g., JIRA, Azure DevOps, ServiceNow).
- Track remediation, validate fixes, and close findings after re‑test.
- Configure, run, and tune DAST or similar tools; integrate results into CI/CD pipelines.
- Build and maintain custom scripts, test environments, proxies, and lab infrastructure.
- Maintain and update test environments, proxies, containers, and mock services.
**Required Skills**
- Hands‑on web and API penetration testing experience.
- Deep knowledge of web protocols (HTTP, cookies, sessions, CORS) and authentication standards (OAuth2/OIDC, JWT, SSO, CSRF).
- API testing proficiency: REST, GraphQL, gRPC; schema validation, pagination, object‑level authorization.
- Familiarity with secure coding in JavaScript/TypeScript, Java/Kotlin, .NET, Python, or Go, and ability to review code for fixes.
- Cloud fundamentals (AWS, Azure, GCP): IAM, WAF, secret management.
- Vulnerability management: CVSS scoring, CWE mapping, SLA‑based remediation workflows (Tenable, Qualys, or custom trackers).
- Strong technical writing, stakeholder communication, and risk translation to business impact.
**Preferred Qualifications**
- CI/CD security integration (GitHub Actions, GitLab CI, Azure DevOps).
- IaC scanning (Terraform, Bicep) and container security.
- Experience with mobile API testing and SSO/federation architectures.
**Required Education & Certifications**
- Bachelor’s degree in Computer Science, Information Security, or related field.
- Professional certifications (OSCP, CEH, CISSP, or equivalent) are an advantage.