Web Application Security Web VAPT OWASP Top 10 Web Application Architecture Business Logic Testing Authentication & Authorization Testing Session Management Input Validation Access-Control Testing API Security REST API SOAP API API Testing OWASP API Top 10 JWT OAuth 2.0 SSO API Authentication & Authorization API Access-Control Testing Source Code Security Source Code Review Secure Code Review Secure Coding Principles SAST Code Vulnerability Analysis Authentication & Authorization Code Review Input Validation & Injection Analysis Security Tools Burp Suite OWASP ZAP SonarQube Fortify Veracode

Bachelor's degree in Computer Science, Information Technology, Cyber Security, or a related technical discipline preferred.

Key Responsibilities

1. Web Application VAPT

Conduct manual and automated Web Application Vulnerability Assessment and Penetration Testing.

Identify and validate application security vulnerabilities.

Perform security testing based on OWASP Top 10 and industry-standard methodologies.

Test application functionality, business logic, authentication, authorization, session management, and access controls.

Identify vulnerabilities such as SQL Injection, XSS, CSRF, SSRF, IDOR, RCE, XXE, authentication weaknesses, authorization issues, and session management vulnerabilities.

Perform vulnerability validation using appropriate security tools.

Identify business logic vulnerabilities and potential attack paths.

2. API Security Assessment

Perform security testing of REST and SOAP APIs.

Assess API endpoints for authentication, authorization, input validation, and access-control vulnerabilities.

Test APIs against the OWASP API Security Top 10.

Assess JWT, OAuth 2.0, and SSO authentication mechanisms.

Identify IDOR/BOLA and broken access-control vulnerabilities.

Assess rate limiting, input validation, error handling, and sensitive data exposure.

Validate API requests and responses for security weaknesses.

Prepare detailed API security assessment reports.

3. Source Code & Secure Code Review

Perform manual Source Code Review and Secure Code Review.

Analyze application code for insecure coding practices and potential attack vectors.

Review input validation, authentication, authorization, session management, cryptography, injection, secure API implementation, error handling, and sensitive data exposure.

Identify vulnerabilities that may not be detected through automated testing.

Provide practical secure-coding recommendations to developers.

Support development teams in resolving identified security vulnerabilities.

4. SAST & DAST

Perform security testing using SAST and DAST methodologies.

Configure and execute security scans using:

SonarQube

Fortify

Veracode

Burp Suite

OWASP ZAP

Review automated scan results and identify false positives.

Manually validate critical and high-risk findings.

Prioritize vulnerabilities based on technical and business impact.

Track vulnerabilities through remediation and retesting.

5. Authentication & Authorization Testing

Assess application authentication mechanisms for security weaknesses.

Test password policies, authentication workflows, account lockout, and access controls.

Assess JWT and OAuth 2.0 implementations.

Test SSO authentication and authorization flows.

Identify privilege escalation and broken access-control vulnerabilities.

Validate session management and timeout controls.

Test token handling and authorization mechanisms.