Security Test Engineer

Security Test Engineer – Job Description

Job Title

Security Test Engineer / Application Security Test Engineer

Job Summary

We are looking for a Security Test Engineer to identify, validate, and report security vulnerabilities in web applications, APIs, mobile applications, and enterprise systems. The role involves security testing throughout the SDLC and working with development, QA, DevOps, and security teams to improve application security.

Key Responsibilities

• Analyze requirements and identify security testing scenarios.
• Create security test plans, test cases, and test data.
• Perform Web Application Security Testing.
• Perform API Security Testing.
• Perform mobile application security testing when required.
• Identify vulnerabilities such as:
  • SQL Injection
  • Cross-Site Scripting (XSS)
  • Cross-Site Request Forgery (CSRF)
  • Broken Authentication
  • Broken Authorization
  • IDOR
  • Session management issues
  • Security misconfiguration
  • Sensitive data exposure
  • File-upload vulnerabilities
• Perform authentication and authorization testing.
• Validate role-based access control (RBAC).
• Test JWT, OAuth, cookies, sessions, and access tokens.
• Perform vulnerability scanning and security assessments.
• Analyze application logs and security findings.
• Reproduce and validate reported vulnerabilities.
• Perform regression security testing after vulnerabilities are fixed.
• Collaborate with developers to understand and remediate security defects.
• Prepare security test reports and vulnerability documentation.
• Participate in threat modeling and risk assessment.
• Integrate security testing into CI/CD pipelines.
• Track vulnerabilities using JIRA or security-management tools.
• Follow OWASP and organizational security standards.

Security Testing Areas

1. Authentication

• Valid/invalid credentials
• Password policy
• Account lockout
• MFA
• Session timeout
• Password reset
• Token expiration

2. Authorization

• Horizontal privilege escalation
• Vertical privilege escalation
• Role-based access
• Unauthorized API access
• IDOR

3. Input Validation

• SQL Injection
• XSS
• Command injection
• Path traversal
• Malicious file uploads

4. API Security

• Authentication
• Authorization
• Token validation
• Rate limiting
• Input validation
• Sensitive information exposure
• API abuse scenarios

Tools

Common tools include:

• Burp Suite
• OWASP ZAP
• Postman
• Nessus
• Nmap
• Wireshark
• Metasploit
• SonarQube
• Snyk
• Trivy
• Checkmarx
• Fortify

Automation / Programming

Knowledge of one or more:

• Java
• Python
• JavaScript
• Selenium / Playwright
• REST Assured
• Bash/Shell scripting

Security automation can include:

CI/CD → Security Scan → Automated Security Tests → Vulnerability Report → Quality/Security Gate → Deployment

API & Database Skills

• REST/SOAP APIs
• HTTP/HTTPS
• JSON/XML
• HTTP headers
• Cookies
• JWT
• OAuth 2.0
• SQL
• Database security basics

DevSecOps Knowledge

Good understanding of:

• Secure SDLC
• CI/CD
• SAST
• DAST
• SCA
• Container security
• Dependency vulnerability scanning
• Secrets scanning
• Security gates
• Docker/Kubernetes security basics

Certifications – Good to Have

• Security+
• CEH
• eJPT
• OSCP — advanced penetration testing
• CISSP — generally for experienced security professionals

Experience

Resume Keywords

Security Testing | Application Security | Web Security | API Security | OWASP | OWASP Top 10 | Burp Suite | OWASP ZAP | SQL Injection | XSS | CSRF | IDOR | Authentication | Authorization | JWT | OAuth | SAST | DAST | SCA | DevSecOps | CI/CD | Vulnerability Assessment | Penetration Testing | REST API | Postman | Python | Java | Git | Jenkins