TECHNICAL LEAD - Penetration Testing

Technical Lead - Application Security & API Security

Role Overview:

• The Technical Lead - Application & API Security will be responsible for leading end-to-end security assessments, including web application penetration testing and API security testing. The role involves technical leadership, client coordination, quality assurance of deliverables, and driving remediation guidance to improve overall security posture.

• This role requires strong expertise in risk-based security assessment methodologies, OWASP standards, and hands-on penetration testing across modern applications and APIs.

  Key Responsibilities

  1. Technical Leadership & Delivery Oversight

• Lead and oversee execution of application penetration testing and API security assessments using risk-based methodologies.
• Ensure quality and accuracy of vulnerability findings, reports, and remediation recommendations.

• Act as the technical owner for assessment activities including planning, execution, validation, and reporting.

  2. Security Assessment Execution

• Drive comprehensive web application security testing, including:
  • Authentication, authorization, and session management testing
  • Input validation (SQL Injection, XSS, command injection, etc.)
  • Business logic flaw analysis
  • Encryption and access control validation

• Lead API security testing, including:

  • Parameter tampering, fuzz testing, authentication flaws
  • Injection attacks (SQL/XPath/XML)
  • Session attacks, replay attacks, and API abuse scenarios

  3. Methodology & Testing Approach

• Implement dynamic application security testing (DAST) combining manual and automated techniques.

• Lead assessment lifecycle:

  • Profiling & attack surface identification
  • Automated scanning
  • Manual validation & exploitation
  • Risk scoring and reporting (CVSS-based)

  4. Stakeholder & Client Coordination

• Coordinate with client development and application teams for:
  • Kick-off discussions and requirement elicitation
  • Daily/periodic status updates and interim findings
  • Risk validation and closure discussions

• Lead stakeholder presentations to explain findings, risks, and mitigation strategies.

  5. Reporting & Deliverables Management

• Ensure delivery of:
  • Detailed vulnerability assessment reports
  • Executive summaries
  • Risk register and tracking dashboards
  • Weekly/monthly progress reports

• Maintain application security risk register and ensure effective tracking of remediation.

  6. Remediation & Advisory

• Provide hands-on guidance to development teams to remediate vulnerabilities.
• Support re-testing and validation of fixes within defined SLA timelines.

• Drive secure coding awareness and best practices.

  7. Quality & Compliance

• Ensure adherence to industry standards:
  • OWASP, SANS, CREST, NIST, OSSTIMM
• Validate severity classification and risk prioritization using CVSS scoring frameworks.

Required Skills & Competencies:

Technical Skills

• Strong expertise in:
  • Web Application Penetration Testing
  • API Security Testing (REST/SOAP)
  • Vulnerability Assessment tools and techniques
• Deep understanding of:
  • OWASP Top 10 & API Security Top 10 including AI testing
  • Authentication, authorization, encryption mechanisms
  • Secure coding practices
• Hands-on experience with tools such as:
  • Burp Suite, OWASP ZAP, Nessus, Nmap, postman etc.
• Leadership & Delivery Skills
• Ability to lead security engagements end-to-end
• Strong stakeholder management and communication skills
• Experience in managing cross-functional teams (Dev, Infra, Security)
• Ability to mentor junior security consultants
• Experience & Qualifications
• 6 to 9 years of experience in application security / penetration testing
• Prior experience in Technical Lead / Security Lead role
• Certifications (preferred):
  • CEH, OSCP, GWAPT, CISSP or equivalent
• Key Deliverables Owned
• Security assessment reports (AI, Application & API)
• Executive dashboards and summaries with enterprise level presentations
• Risk register and remediation tracking
• Client presentations and advisory artefacts
• Additional Expectations
• Ensure timely retesting and closure of vulnerabilities
• Maintain strong focus on risk reduction and security posture improvement
• Drive continuous improvement in testing methodologies and engagement quality

Job Location: Bangalore

Skills Required
Postman, Nmap, Burp Suite, Owasp Top 10, Web Application Penetration Testing, Nessus