Security Consultant – AppSec & Penetration Testing

About the role

We are looking for a Senior Security Consultant to lead application security assessments and penetration testing for web, mobile, and API solutions. The role involves integrating security into the software development lifecycle and collaborating closely with development teams.

Key responsibilities

• Perform manual and automated security assessments and penetration testing of web applications, APIs, Android and iOS apps.
• Configure and manage SAST, DAST and Software Composition Analysis tools, especially the Veracode platform.
• Implement Secure SDLC and DevSecOps practices, embedding automated tests into CI/CD pipelines using GitHub Enterprise or equivalent.
• Conduct API security testing (REST, SOAP, OAuth 2.0, OpenID Connect, JWT) and apply OWASP methodologies.
• Prepare detailed assessment reports with actionable remediation recommendations and support continuous security improvements.

Required profile

• Minimum 5 years of relevant experience in application security and penetration testing.
• Preferred certifications: OSCP, OSWE, GWAPT, CSSLP, Burp Suite Certified Practitioner, Veracode certification; CISSP, CISM or GSEC are a plus.

Required skills

• Application security assessment and penetration testing.
• SAST, DAST, Software Composition Analysis (Veracode).
• Secure SDLC, DevSecOps, CI/CD integration (GitHub Enterprise/Actions).
• API security testing (REST, SOAP, OAuth 2.0, OpenID Connect, JWT).
• OWASP frameworks (Top 10, ASVS, WSTG, API Security Top 10, MASVS/MSTG).
• Burp Suite Professional or equivalent testing tools.