Lead Consultant (Application Security testing- DAST)

Lead Consultant (Application Security testing- DAST)

Wipro is looking for senior penetration tester to join our team to test and secure Wipro's internal application stack. The ideal candidate will be responsible for conducting comprehensive security assessments, including Dynamic Application Security Testing (DAST), grey box penetration testing, and both manual and automated testing methodologies. The role requires expertise in testing various platforms, including web applications, mobile applications, thick client applications, and APIs. The candidate should possess a strong understanding of security principles, vulnerabilities, and exploits, along with the ability to simulate real-world attack scenarios to identify and mitigate security risks. This position demands a proactive and analytical mindset, excellent problem-solving skills, and the ability to communicate findings effectively to stakeholders.

• Conduct comprehensive grey box penetration testing on web, APIs, mobile, and thick client applications.
• Perform in-depth manual assessments to showcase the exploitation steps of vulnerabilities to understand their impact.
• Develop and execute advanced test plans and methodologies to simulate sophisticated attack scenarios, penetration testing SOP, reports, and remediation guidance.
• Utilize and manage automated scanning tools (e.g., Burp Suite, Webinspect)
• Collaborate with development teams to remediate identified vulnerabilities and provide security recommendations.
• Review and test change requests as part of DevSecOps to ensure ongoing security compliance.
• Mentor and train junior penetration testers, sharing best practices and techniques.
• Stay updated on the latest security threats, vulnerabilities, and technology trends.
• Liaising with DevOps team and DAST tool vendor to enable integration of security testing within the CI/CD pipeline to ensure continuous security validation.
• Prepare and deliver comprehensive dashboards and presentations to technical and executive management teams.

• Bachelor’s degree in a technical field
• 8-10 years of experience in application security testing
• Should have hands-on experience in:
  • Dynamic Application Security Testing (DAST)
  • Grey box manual penetration testing for web, APIs, mobile, and thick client applications
• Good to have:
  • experience in Static Application Security Testing (SAST)
  • Utilizing automated scanners for web applications (preferably Webinspect and Macro creations in it)
  • certifications such as OSCP, CEH, GPEN, CISSP, or similar preferred

Dynamic Application Security Testing (DAST)

Manual penetration Testing (Grey box)

Mobile and Thick client penetration testing

API penetration testing

Burp Suite

Postman

Automated scanning