Application Security Engineer

Application Security Engineer

Required Qualifications:
• Bachelor's degree in Information Security, Computer Science, or a related field, or equivalent practical experience.
• 5+ years of experience in application security, penetration testing, or vulnerability research.
• Hands-on experience finding and exploiting business logic and access control flaws in APIs (REST, GraphQL).
• Deep working knowledge of the OWASP Top 10 and the OWASP API Security Top 10.
• Proficiency with manual testing tools such as Burp Suite Professional, including request manipulation and custom test cases.
• Hands-on experience operating and tuning SAST and DAST tools such as Snyk, SonarQube, and Qualys, including triaging their output and reducing false positives.
• Ability to read and review code in at least one modern language (for example, Python, Java, Go, or JavaScript/TypeScript).
• Working knowledge of AWS security, particularly IAM, S3, Lambda, and API Gateway, and how misconfigurations create application attack paths.
• Experience with Wiz and Qualys, or comparable CNAPP and vulnerability management platforms, with a record of turning automated scan or attack-testing output into validated, prioritized findings.
• Nice to have Hands-on experience any comparable SOAR platform, including building playbooks andintegrations for vulnerability management workflows/Automating.

Preferred Qualifications:
• Experience with automated or AI-assisted penetration testing and continuous DAST platforms.
• Experience writing custom rules and quality profiles in SonarQube or Snyk.
• AWS Certified Security – Specialty.
• Offensive security certifications such as OSCP, OSWE, BSCP, or GWAPT.
• Bug bounty participation or published vulnerability research