Security Test Engineer

We are looking for a Security Test Engineer to identify, validate, and report security vulnerabilities in web applications, APIs, mobile applications, and enterprise systems. The role involves security testing throughout the SDLC and working with development, QA, DevOps, and security teams to improve application security., * Analyze requirements and identify security testing scenarios.

• Create security test plans, test cases, and test data.
• Perform Web Application Security Testing.
• Perform API Security Testing.
• Perform mobile application security testing when required.
• Identify vulnerabilities such as:
• SQL Injection
• Cross-Site Scripting (XSS)
• Cross-Site Request Forgery (CSRF)
• Broken Authentication
• Broken Authorization
• IDOR
• Session management issues
• Security misconfiguration
• Sensitive data exposure
• File-upload vulnerabilities
• Perform authentication and authorization testing.
• Validate role-based access control (RBAC).
• Test JWT, OAuth, cookies, sessions, and access tokens.
• Perform vulnerability scanning and security assessments.
• Analyze application logs and security findings.
• Reproduce and validate reported vulnerabilities.
• Perform regression security testing after vulnerabilities are fixed.
• Collaborate with developers to understand and remediate security defects.
• Prepare security test reports and vulnerability documentation.
• Participate in threat modeling and risk assessment.
• Integrate security testing into CI/CD pipelines.
• Track vulnerabilities using JIRA or security-management tools.
• Follow OWASP and organizational security standards.

Security Testing Areas

1. Authentication * Valid/invalid credentials * Password policy * Account lockout * MFA * Session timeout * Password reset * Token expiration

2. Authorization * Horizontal privilege escalation * Vertical privilege escalation * Role-based access * Unauthorized API access * IDOR

3. Input Validation * SQL Injection * XSS * Command injection * Path traversal * Malicious file uploads

4. API Security * Authentication * Authorization * Token validation * Rate limiting * Input validation * Sensitive information exposure * API abuse scenarios

Tools

Common tools include:

• Burp Suite
• OWASP ZAP
• Postman
• Nessus
• Nmap
• Wireshark
• Metasploit
• SonarQube
• Snyk
• Trivy
• Checkmarx
• Fortify

Automation / Programming

Knowledge of one or more:

• Java
• Python
• JavaScript
• Selenium / Playwright
• REST Assured
• Bash/Shell scripting

Security automation can include:

CI/CD Security Scan Automated Security Tests Vulnerability Report Quality/Security Gate Deployment

API & Database Skills

• REST/SOAP APIs
• HTTP/HTTPS
• JSON/XML
• HTTP headers
• Cookies
• JWT
• OAuth 2.0
• SQL
• Database security basics

Good understanding of:

• Secure SDLC
• CI/CD
• SAST
• DAST
• SCA
• Container security
• Dependency vulnerability scanning
• Secrets scanning
• Security gates
• Docker/Kubernetes security basics

Certifications Good to Have

• Security
• CEH
• eJPT
• OSCP advanced penetration testing
• CISSP generally for experienced security professionals

Experience Experience Typical Role 0 2 years Junior Security Test Engineer 2 5 years Security Test Engineer 5 8 years Senior Security Test Engineer 8 years Security Testing Lead / Security Architect Resume Keywords