Job Description: Security Testing Sr Engineer (DAST & SAST)

Preferred (Bangalore - Location)

About the Role

We're looking for a highly skilled and experienced Security testing Sr Engineer to join our

dynamic team in the Bangalore office. The ideal candidate will have a strong background in

securing the SDLC for banking and NBFC applications, with deep expertise in various security

tools and methodologies. Responsible for integrating security practices into our DevOps

pipelines, ensuring our applications and infrastructure are protected against a range of threats.

This is a hands-on role requiring an immediate joiner with a proactive approach to security.

Key Responsibilities

Pipeline Security Integration: Design, implement, and manage security tools and processes

within the CI/CD pipeline.

Vulnerability Management: Oversee and lead VAPT (Vulnerability Assessment and

Penetration Testing) efforts for all applications.

Tool Expertise: Administer and operate a suite of security tools, including: SAST

(Static Application Security Testing): Checkmarx, SonarQube. Snyx SCA

(Software Composition Analysis): Snyk.

DAST (Dynamic Application Security Testing): Acunetix, Burp Suite, AppScan.

Threat Modeling: Conduct threat modeling exercises to identify potential security risks early in

the development lifecycle.

Security Automation: Automate security testing and vulnerability scanning processes to

improve efficiency and reduce manual intervention.

Collaboration: Work closely with development, operations, and QA teams to remediate

vulnerabilities and promote a security-first culture.

Reporting: Generate and present detailed reports on security posture, vulnerability trends, and

remediation progress to senior management.

Mentorship: Mentor and guide junior team members on DevSecOps best practices and security

tools.

Required Skills & Qualifications

Experience: 5-6 years of relevant experience with Application Security, or a similar role,

preferably within the Banking or NBFC sector.

Technical Proficiency: Extensive, hands-on experience with SAST, SCA (open source) and

DAST tools as listed above.

Security Knowledge: In-depth understanding of application security vulnerabilities, including

OWASP Top 10, and common attack vectors.

Pipeline Knowledge: Working Knowledge of CI/CD pipelines and experience integrating

security tools into them.

VAPT: Proven experience in conducting and coordinating VAPT activities.

Problem-Solving: Excellent analytical and problem-solving skills with a keen eye for detail.

Communication: Strong communication and interpersonal skills, with the ability to articulate

complex security concepts to non-technical stakeholders.

Security Testing