Application Security Consultant – DAST

About the role

We are seeking a highly skilled and experienced Application Security Consultant to advance our application security initiatives, with a particular emphasis on dynamic application security testing (DAST). You will own and mature how we test running applications and APIs for exploitable weaknesses, drive secure development practices, and implement solutions that protect our systems and data from evolving threats.

Key responsibilities

• Own and advance the DAST program, selecting, deploying, configuring, and maintaining tooling across web applications and APIs.
• Design and run authenticated dynamic scans for complex applications, including session handling, multi‑step workflows, SPA and REST/GraphQL APIs.
• Integrate DAST into CI/CD pipelines and pre‑production environments, defining release‑gate thresholds.
• Triage, validate, and tune DAST output, eliminating false positives and providing actionable remediation guidance.
• Complement automated testing with manual techniques to identify OWASP Top 10 vulnerabilities not surfaced by scanners.
• Collaborate with security architects, DevOps, and development teams to embed security controls throughout the software development lifecycle.

Required profile

• Bachelor’s degree.
• 8+ years of experience in application security, penetration testing, or secure software development.

Required skills

• Hands‑on expertise with DAST tools such as Burp Suite, OWASP ZAP, Invicti, Acunetix, StackHawk.
• Security certifications (e.g., CEH, OSCP, CISSP, GWAPT).
• Deep knowledge of OWASP Top 10 and secure software development methodologies.
• Experience with DevSecOps and CI/CD integration.
• Cloud security experience (AWS, Azure, GCP) and container security (Docker, Kubernetes).
• Proficiency in programming languages (Java, JavaScript, C#, Python) and build tools (Maven, Gradle, Node.js).
• Familiarity with automation tools (Terraform, GitHub Actions, Jenkins, AWS CloudFormation).
• Understanding of encryption, authentication, access control, and compliance frameworks (SOC 2).