Sr Security Consultant – Web, Mobile, API & SCR

Role Overview

Key Responsibilities

• Perform Web Application Security Testing based on OWASP Top 10 and industry-standard methodologies.
• Conduct Mobile Application Security Testing for Android/iOS.
• Perform API Security Testing using Burp Suite, Postman, OWASP ZAP, etc.
• Conduct Secure Code Review (SCR) and identify insecure coding practices.
• Identify and validate vulnerabilities related to authentication, authorization, access control, injection, session management, sensitive data, business logic and API security.
• Perform vulnerability retesting and remediation validation.
• Prepare detailed VAPT/security assessment reports with evidence, impact and remediation recommendations.
• Perform/support security testing of UPI/payment applications, including API security, transaction flows, authentication, authorization and business logic.
• Support PCI-DSS and other security audits with VAPT reports, evidence, remediation and retest documentation.
• Coordinate with development/application teams for vulnerability remediation and closure.
• Handle client queries and participate in security review meetings.

Team Handling & Coordination

• Coordinate day-to-day activities of junior security testers.
• Allocate testing tasks and track assessment deliverables and timelines.
• Review vulnerability findings and reports for quality and technical accuracy.
• Mentor junior team members on application security testing and vulnerability validation.
• Coordinate with project managers, developers, application owners and client stakeholders.
• Support multiple security assessments and track remediation/closure.

Audit & Compliance Support

• Support PCI-DSS audits/assessments and client security compliance requirements.
• Prepare audit evidence including VAPT reports, scope, methodology, findings, remediation and retest results.
• Coordinate with auditors and stakeholders for security testing-related queries.
• Maintain assessment documentation and evidence for audit readiness.

Required Skills

• 3–6 years of hands-on Application Security / VAPT experience.
• Strong experience in Web, API and Mobile Security Testing.
• Hands-on experience in Secure Code Review.
• Strong knowledge of OWASP Top 10 and application security fundamentals.
• Understanding of JWT, OAuth, API authentication/authorization and business logic vulnerabilities.
• Hands-on experience with Burp Suite, Postman, MobSF and OWASP ZAP.
• Exposure to Frida / Objection is an advantage.
• BFSI, UPI/payment application and PCI-DSS exposure preferred.
• Good technical report writing, communication and stakeholder management skills.
• Team coordination/mentoring experience preferred.

Certifications – Preferred

• eWPT / eMAPT
• CEH
• OSCP / OSWE
• CREST or equivalent

Qualification

• Bachelor's degree in Computer Science / IT / Cybersecurity or equivalent.
• Strong analytical, communication and documentation skills.
• Ability to work in a structured, compliance-driven BFSI environment.