Application Security Specialist

We are seeking a seasoned Application Security Specialist to lead the design and implementation of secure software development practices across our organization.

Experience: 8+ years

Responsibilities

Security Testing

• Conduct Static Application Security Testing (SAST) and Software Composition Analysis (SCA)
• Perform Dynamic Application Security Testing (DAST) and Interactive Application Security Testing (IAST) for deeper analysis of vulnerabilities during runtime
• Execute Mobile Application Security Testing and API Security Testing to safeguard against OWASP Security risks
• Ensure applications are resilient to real-world attack vectors

Vulnerability Management and Threat Mitigation

• Identify, prioritize, and remediate vulnerabilities through Vulnerability Assessments and Penetration Testing (VAPT)
• Identify and mitigate vulnerabilities aligned with the latest OWASP Top 10 risks, including Injection, Broken Access Control, and Insecure Design
• Assess and remediate vulnerabilities in accordance with OWASP Application Security Verification Standard (ASVS)
• Use Threat Modeling to predict, identify, and mitigate potential security threats early in the development lifecycle
• Provide detailed report analysis and assess the actual business and technical impact of security vulnerabilities o Generate and analyze SAST reports, delivering actionable insights to technical and business stakeholders
• Implement and maintain robust vulnerability management processes

Cloud Security

• Secure cloud environments hosted on AWS and Azure, adhering to CIS Benchmarks and NIST Cybersecurity Framework standards
• Ensure data privacy and protection compliance with GDPR and HIPAA in cloud implementations.
• Implement security controls and frameworks for cloud applications and infrastructure

Compliance and Regulations

• Ensure application and infrastructure compliance with standards such as PCI DSS, HIPAA, and GDPR.
• Conduct regular assessments to align with SANS Top 25 Software Errors, NIST SP 800-53, and CIS Controls.
• Support the creation of secure applications that meet industry compliance and regulatory requirements

DevSecOps Integration

• Embed security practices within the Secure Software Development Lifecycle (SDLC) by automating security checks and remediation
• Collaborate with DevOps teams to integrate security tools and testing into the CI/CD pipelines using Jenkins and Azure DevOps
• Automate security testing and monitoring to support agile development cycles

Security Architecture and Best Practices

• Design secure application architectures to address OWASP Top 10 risks and API specific threats.
• Advocate and enforce secure coding practices throughout the development teams o Integrate OWASP ASVS principles and Threat Modeling to enhance application security Design and implement security architecture for web, mobile, and API applications

Leadership and Training

• Lead security assessments and mentor junior team members on secure application practices.
• Conduct workshops and training sessions on OWASP Top 10, PCI DSS, Secure SDLC, and other key frameworks.
• Act as a subject matter expert (SME) in application security, fostering a culture of security awareness across the organization

Required Skills and Qualifications

Technical Proficiency

• Legacy technologies: Java, .NET
• Modern technologies: React, Node.js, Python, PHP, Ruby/Rails, Angular, etc
• CMS experience with Magento-Adobe and Avocode.

Cloud Skills

• Expertise with AWS and Azure cloud platforms.

Security and Compliance Knowledge.

• Strong understanding of OWASP Top 10, OWASP ASVS, PCI DSS, HIPAA, GDPR, CIS Benchmarks, and NIST Cybersecurity Frameworks.
• Familiarity with SANS Top 25 Software Errors and their remediation strategies

Security Testing Expertise.

• Proficiency in SAST, SCA, DAST, IAST, and penetration testing techniques.
• Experience in Threat Modeling to proactively identify and mitigate risks.
• Strong knowledge of VAPT, mobile, and API security testing

DevSecOps and SDLC Integration

• Expertise in implementing Secure Software Development Lifecycle (SDLC) practices Proficiency in integrating security tools with CI/CD pipelines using Jenkins and Azure DevOps

Soft Skills

• Excellent communication skills to bridge the gap between technical and business teams
• Ability to articulate technical issues to both technical and non-technical audiences Preferred

Certifications

• Certified Information Systems Security Professional (CISSP)
• Certified Ethical Hacker (CEH)
• GIAC Web Application Penetration Tester (GWAPT)
• AWS Certified Security -- Specialty
• Microsoft Certified: Azure Security Engineer Associate

Why QualiZeal?

• Award-Winning Workplace: Certified as a Great Place to Work® and recognized by ET NOW as the Best Organization for Women in 2025.
• Proven Engagement: Industry-recognized client and employee Net Promoter Scores (NPS).
• Growth-Focused Culture: Equal-opportunity employer with a strong emphasis on leadership development, training, and continuous learning.
• Flexible & Supportive Environment: We value empathy, recognize contributions, and support work-life balance.
• Transparent Leadership: Open-book management with a collaborative, inclusive approach.
• Rapid Growth: 850+ professionals strong and on track to reach 3000+ employees — an exciting time to join.

About QualiZeal:

QualiZeal is North America's fastest-growing independent digital quality engineering services company. With a diverse portfolio of digital transformation services encompassing Quality Engineering, Digital Engineering, Advisory and Transformation, and Emerging Technology Testing, QualiZeal empowers organizations of all sizes globally to achieve quality excellence and sustainable market leadership. Trusted by 70+ global enterprises and with a headcount of 850+ elite software quality engineers, QualiZeal is pioneering AI-enabled Quality Engineering innovation. QualiZeal has consistently maintained an outstanding client Net Promoter Score (NPS) of over 75, reflecting its unwavering commitment to client satisfaction and service excellence.