Skills
-
Hands on VA/PT experience in Web, Mobile, SDK, API & Network
-
Thorough understanding of OWASP Top 10, their attack & defense mechanisms
-
Exposure to Secure SDLC Activities, Threat Modelling & Secure Coding
-
Experience with both commercial and open-source tools like Burp suite, AppScan, OWASP ZAP, BEEF, Metasploit, Qualys, Nessus, Synk etc.
-
Identifying and exploiting business logic-related vulnerabilities.
-
Solid understanding of Cryptography, knowledge of PKI-based systems, TLS
-
Understanding of different AuthN/AuthZ frameworks (OIDC, oAuth, SAML) able to read/write/understand java code
-
Performed Static Analysis, Code reviews using tools like Snyk, Veracode, Checkmarx, Sonarqube etc.
-
Hands on Reversing mobile applications, class/small files, data obfuscators, or ciphers (Dex2jar, adb, Drozer, Clang, iMAS) and Dynamic Instrumentation tools like Frida/Objection
-
Execute penetration tests and security assessments on internal and external networks, Windows and Linux environments, cloud (AWS) Infrastructure.
-
Identify and exploit incorrect configurations and security vulnerabilities on Windows and Linux servers. Safely utilize tools, tactics, and procedures used in penetration testing engagements.
-
Shell scripting or automation of simple tasks using Python, or Ruby
-
Knowledge of PCI DSS, PCI SSF (S3, SSLC) etc.
-
Knowledge of security standards like PCI DSS, UIDAI, GDPR, NIST, etc.
-
Understanding Java Frameworks like Springboot, CI/CD, Jenkins.
-
In-depth understanding of production operations on public cloud infrastructure.
-
Excellent written and oral communication and a penchant for technical documentation.
-
Must have participated in various bug bounty programs (HackerOne, Bug Crowd, Private etc)
-
Experience in conducting hackathons and CTF’s
-
Knowledge of AWS/Azure (VPC/Vnet, S3 buckets, blob stores, LoadBalancers etc.), Dockers & Containers, Kubernetes
-
Good understanding of agile development practices.
-
Certifications like OSCP(Preferred), GWAPT, Advanced Web Attacks and Exploitation (AWAE), Comptia Security+
-
Knowledge of Databases - Postgresql, Redshift, My SQL etc. and other data stores like Elasticsearch and S3 buckets.
-
Experience in the FinTech domain is highly desirable.
-
Knowledge of payment key management, cryptographic key handling, and HSM operations will be an added advantage.
-
Cloudflare WAF experience or knowledge in the areas
-
Cloudflare WAF Rules Review and Configuration
-
Cloudflare WAF Rules Tuning
-
Cloudflare Traffic and Event Monitoring
-
Bot Traffic Analysis
-
Detecting and handling anonymous or un-authenticated API Calls.
Experience and Qualifications
-
4+ years of experience in developing large scale internet or SaaS applications.
-
2 to 3 years of overall experience as Web/Mobile Application Security engineer or Developer in medium to large-sized product companies.
-
Bachelor of Technology (BE/B.Tech), M.Tech or ME in Computer Science or equivalent from a Tier-1 engineering college/university.