Application Security Engineer – Security Consultant

Practical DevSecOps

. Plan and execute full-scope penetration tests across web applications, APIs, mobile apps, cloud infrastructure, and internal networks .

Posted 10/15/2026full-timeIndiaMid-LevelSeniorWebsite

Tech Stack

Tools & technologies

AWSAzureCloudDockerGoogle Cloud PlatformJavaJavaScriptKubernetesPythonSDLCTypeScriptGo

About the role

Key responsibilities & impact

Plan and execute full-scope penetration tests across web applications, APIs, mobile apps, cloud infrastructure, and internal networks
Conduct threat modelling exercises and attack surface analysis for client applications and platforms
Perform manual and tool-assisted vulnerability assessments, including business logic flaws, authentication bypasses, injection attacks, and privilege escalation chains
Develop proof-of-concept exploits and document findings with actionable remediation guidance tailored to the client's technology stack
Simulate real-world adversarial scenarios targeting people, processes, and technology
Design and implement Secure-SDLC frameworks, security gates, and shift-left practices
Integrate and tune SAST, DAST, SCA, IaC scanning, and secrets detection tools within CI/CD pipelines
Review source code for security vulnerabilities across Python, Java, JavaScript/TypeScript, Go, and C#
Define and implement API security controls, including OAuth 2.0/OIDC configurations, rate limiting, and input validation frameworks
Conduct secure architecture reviews, threat modelling workshops, and cloud security assessments across AWS, Azure, and GCP
Develop and deliver security training and awareness sessions for engineering, QA, and product teams
Act as the primary security point of contact for client engagements and manage stakeholder communication throughout the project lifecycle
Produce executive reports, technical findings, remediation roadmaps, and security architecture diagrams
Contribute to pre-sales activities, including scoping calls, proposal development, and RFP responses
Collaborate with internal teams to develop service offerings, training content, and thought leadership materials

Requirements

What you’ll need

5–8 years of hands-on security experience, with demonstrable depth in both penetration testing and application security / DevSecOps
Proficiency with industry-standard offensive security tools: Burp Suite Pro, Metasploit, Nmap, Nessus/OpenVAS, BloodHound, Cobalt Strike (or equivalents)
Strong knowledge of OWASP Top 10 (Web & API), CWE/SANS Top 25, MITRE ATT&CK, and CVSS scoring
Experience with at least one major cloud platform (AWS, Azure, or GCP) and familiarity with cloud-native services, IAM misconfigurations, and serverless security
Hands-on experience integrating security tooling (SAST, DAST, SCA, secrets scanning) into CI/CD pipelines
Solid scripting skills in Python, Bash, or PowerShell for automation and custom tooling
Excellent written and verbal communication — able to present technical findings to both engineering teams and C-suite executives
Relevant certifications are preferred: OSCP, OSEP, BSCP, GWAPT, GWEB, CEH, CSSLP, AWS Security Specialty, or equivalent
Familiarity with compliance frameworks is preferred: SOC 2, ISO 27001, PCI-DSS, NIST CSF, or CIS Controls
Experience with container security (Docker, Kubernetes), service mesh, and zero-trust architecture is preferred
Prior consulting or client-facing experience in a professional services environment is preferred
Contributions to open-source security projects, CVE disclosures, or published security research are preferred

Benefits

Comp & perks

Competitive salary benchmarked globally
Performance-linked annual bonus
Paid time off + regional public holidays
Annual certification & training budget
Access to required practical DevSecOps courses
Speak at conferences & publish research