Application Security Engineer/Penetration Tester

Job Summary :

Key Responsibilities :

- Conduct business logic testing and fraud simulation, including scenarios like bid manipulation, price tampering, replay attacks, fake approvals, and maker-checker bypass.

- Execute controlled attack simulations to validate business rules, access controls, data validations, and system behavior under failure scenarios (errors, concurrency, integration issues).

- Identify and help remediate critical vulnerabilities, especially in Government/PSU or large-scale procurement/financial systems.

- Test and secure authentication mechanisms, session/token management, API endpoints, and input validation.

- Analyze and simulate e-procurement fraud patterns such as bid rigging, multi-account collusion, forged bids, transaction replay, and audit trail manipulation.

- Use advanced security tools like Burp Suite, OWASP ZAP, Kali Linux, Metasploit, along with custom scripts for attack simulation.

- Clearly document vulnerabilities and articulate business impact (financial loss, unfair deal awards, reputational risks).

- Collaborate with development and product teams to ensure secure design, remediation, and compliance.

Mandatory Skills & Experience :

- Strong hands-on expertise in business logic testing and fraud simulation.

- Proficiency in security testing tools : Burp Suite, OWASP ZAP, Kali Linux, Metasploit.

- Strong knowledge of authentication, session/token security, API security, and input manipulation techniques.

- Experience in identifying vulnerabilities with clear business impact assessment.

- Bachelors degree in Engineering/IT (B.Tech/BE) or MCA.

- At least one certification: OSCP / OSWE / CEH Practical / CREST.

Preferred Qualifications :

- Deep understanding of e-procurement or marketplace fraud patterns.

- Strong analytical and problem-solving skills.