{"id":2598061,"url":"https://alion.io/job/deloitte-application-security-engineer-sast-dast","title":"Application Security Engineer - SAST & DAST","company":{"id":272,"name":"Deloitte","domain":"deloitte.com","url":"https://alion.io/company/deloitte","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Avature","truth_index":{"grade":"B","score":83,"open_postings":10,"ghost_share":0,"stale_share":0.9,"repost_share":0,"time_to_fill_p50_days":16,"computed_at":"2026-10-15T05:46:00Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Bengaluru, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CVSS","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"SQL","optional":false}],"status":"live","first_seen_at":"2026-10-15T07:45:51Z","employer_posted_date":null,"last_verified_at":"2026-10-15T07:45:51Z","board_verified":false,"closed_at":null,"days_open":0,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":0},"description":"We are looking for an experienced Application Security / Web Penetration Testing professional with strong hands-on expertise in manual and automated security testing of web applications. The ideal candidate should have a solid understanding of the OWASP Top 10, vulnerability assessment methodologies, risk prioritisation, and secure remediation practices. The candidate will be responsible for identifying and validating application security vulnerabilities, assessing their business impact, preparing detailed security reports, and working closely with development and business stakeholders throughout the vulnerability remediation lifecycle.\nResponsibilities:\nConduct manual and automated security testing of web applications to identify security vulnerabilities and weaknesses.\nPerform application security assessments covering authentication, authorisation, session management, input validation, business logic, API security, and other application components.\nDemonstrate strong knowledge and practical application of the OWASP Top 10 framework.\nIdentify, validate, and exploit vulnerabilities using appropriate penetration testing methodologies and tools.\nAnalyse vulnerabilities and prioritise findings based on: Severity, Exploitability, Business impact, Compliance implications, exposure, and attack likelihood\nPerform vulnerability validation and develop Proof of Concept (PoC) demonstrating the impact and exploitability of identified vulnerabilities.\nPrepare comprehensive security assessment and penetration testing reports containing: Vulnerability description, Affected application/component, Technical details, Evidence/screenshots, Proof of Concept, Risk rating/severity, Business impact, Remediation recommendations\nCollaborate with developers, application owners, architects, and other stakeholders to explain security findings.\nProvide practical security guidance and remediation recommendations throughout the vulnerability remediation lifecycle.\nTrack identified vulnerabilities and support development teams in understanding and resolving security issues.\nPerform retesting/reassessment of remediated vulnerabilities to confirm that fixes are effective.\nVerify that remediation activities have not introduced new security vulnerabilities or regression issues.\nPresent security findings, risk implications, and remediation priorities to technical teams and executive stakeholders.\nStay current with emerging web application vulnerabilities, attack techniques, security standards, and application security best practices.\nRequirements:\nStrong hands-on experience in Web Application Security Testing / Penetration Testing.\nStrong understanding of OWASP Top 10 and common web application vulnerabilities.\nExperience with vulnerabilities such as: SQL Injection, Cross-Site Scripting (XSS), CSRF, Broken Access Control, IDOR/BOLA, Authentication and Session Management issues, Security Misconfiguration, SSRF, File Upload vulnerabilities, Command Injection, XXE, Path Traversal, Business Logic vulnerabilities, API security vulnerabilities.\nExperience performing both manual and automated vulnerability assessments.\nAbility to understand application architecture, request/response flows, authentication mechanisms, and APIs.\nStrong ability to validate vulnerabilities and distinguish true positives from false positives.\nExperience creating detailed PoCs and technical security reports.\nGood understanding of vulnerability severity and risk-rating methodologies such as CVSS.\nKnowledge of secure coding and application security remediation practices.","description_format":"text","description_chars":3567,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security"],"lifecycle":[{"event":"open","at":"2026-10-15T07:45:51Z"}],"visa":[{"country":"GB","licensed_sponsor":true,"evidence":"Licensed UK visa sponsor (Senior or Specialist Worker, Skilled Worker)","filings_12m":null,"filings_prev_12m":null,"green_card_filings_12m":null,"median_offered_wage_usd":null,"route":"Global Business Mobility: Senior or Specialist Worker; Skilled Worker","cap_exempt":false,"checked_at":"2026-10-15T06:21:15+00:00","sources":["UK Home Office: register of licensed sponsors (workers)"],"filings_for_role_12m":0}],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":16,"reasons":["seen:0","win:early","comp:brand"],"computed_at":"2026-10-15T19:58:36Z"},"pay":null,"html_url":"https://alion.io/job/deloitte-application-security-engineer-sast-dast","json_url":"https://alion.io/job/deloitte-application-security-engineer-sast-dast.json","meta":{"generated_at":"2026-10-15T19:58:36Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":30311,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-16T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":272},"rest":"https://alion.io/mcp/rest/get_company?id=272"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fdeloitte-application-security-engineer-sast-dast"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fdeloitte-application-security-engineer-sast-dast"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fdeloitte-application-security-engineer-sast-dast"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/deloitte-application-security-engineer-sast-dast\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fdeloitte-application-security-engineer-sast-dast"}]}