TECHNICAL LEAD - Penetration Testing
Happiest Minds Technologies · IT Services & Consulting
- Bengaluru
- On-site
- Posted today
- Cybersecurity
About the job
Technical Lead - Application Security & API Security
Required Experience: 8 to 12 Years
Location: Bangalore
Role Overview:
The Technical Lead - Application & API Security will be responsible for leading end-to-end security assessments, including web application penetration testing and API security testing. The role involves technical leadership, client coordination, quality assurance of deliverables, and driving remediation guidance to improve overall security posture.
This role requires strong expertise in risk-based security assessment methodologies, OWASP standards, and hands-on penetration testing across modern applications and APIs.
Key Responsibilities
1. Technical Leadership & Delivery Oversight
Lead and oversee execution of application penetration testing and API security assessments using risk-based methodologies.
Ensure quality and accuracy of vulnerability findings, reports, and remediation recommendations.
Act as the technical owner for assessment activities including planning, execution, validation, and reporting.
Security Assessment Execution
Drive comprehensive web application security testing , including: - Authentication, authorization, and session management testing
Input validation (SQL Injection, XSS, command injection, etc.)
Business logic flaw analysis
Encryption and access control validation
Lead API security testing , including:
Parameter tampering, fuzz testing, authentication flaws
Injection attacks (SQL/XPath/XML)
Session attacks, replay attacks, and API abuse scenarios
Methodology & Testing Approach
Implement dynamic application security testing (DAST) combining manual and automated techniques.
Lead assessment lifecycle:
Profiling & attack surface identification
Automated scanning
Manual validation & exploitation
Risk scoring and reporting (CVSS-based)
Stakeholder & Client Coordination
Coordinate with client development and application teams for: - Kick-off discussions and requirement elicitation
Daily/periodic status updates and interim findings
Risk validation and closure discussions
Lead stakeholder presentations to explain findings, risks, and mitigation strategies.
Reporting & Deliverables Management
Ensure delivery of: - Detailed vulnerability assessment reports
Executive summaries
Risk register and tracking dashboards
Weekly/monthly progress reports
Maintain application security risk register and ensure effective tracking of remediation.
Remediation & Advisory
Provide hands-on guidance to development teams to remediate vulnerabilities.
Support re-testing and validation of fixes within defined SLA timelines.
Drive secure coding awareness and best practices.
Quality & Compliance
Ensure adherence to industry standards: - OWASP, SANS, CREST, NIST, OSSTIMM
Validate severity classification and risk prioritization using CVSS scoring frameworks.
Required Skills & Competencies:
Technical Skills
Strong expertise in: - Web Application Penetration Testing
API Security Testing (REST/SOAP)
Vulnerability Assessment tools and techniques
Deep understanding of: - OWASP Top 10 & API Security Top 10 including AI testing
Authentication, authorization, encryption mechanisms
Secure coding practices
Hands-on experience with tools such as: - Burp Suite, OWASP ZAP, Nessus, Nmap, postman etc.
Leadership & Delivery Skills
Ability to lead security engagements end-to-end
Strong stakeholder management and communication skills
Experience in managing cross-functional teams (Dev, Infra, Security)
Ability to mentor junior security consultants
Experience & Qualifications:
8+ years of experience in application security / penetration testing
Prior experience in Technical Lead / Security Lead role
Certifications (preferred): - CEH, OSCP, GWAPT, CISSP or equivalent
Key Deliverables Owned
Security assessment reports (AI, Application & API)
Executive dashboards and summaries with enterprise level presentations
Risk register and remediation tracking
Client presentations and advisory artefacts
Additional Expectations
Ensure timely retesting and closure of vulnerabilities
Maintain strong focus on risk reduction and security posture improvement
Drive continuous improvement in testing methodologies and engagement quality