Website:
cysigil.com
Job details:
Company: Cysigil
Location: Bengaluru, India — On-site
Employment type: Full-time
Experience: 2 years +
Function: Offensive Security / Vulnerability Assessment & Penetration Testing
Reports to: Lead Security Consultant — VAPT
About the role
Cysigil delivers vulnerability assessment and penetration testing engagements across web applications, APIs, networks, mobile apps and cloud environments for clients in BFSI, healthcare, SaaS and manufacturing.
We are hiring an Associate Security Analyst (L2) to join the VAPT practice. This is a hands-on, delivery-facing role.
Role Summary
Perform static application security testing and manual secure code reviews across web, API, and mobile codebases. Triage SAST tool output, determine exploitability, and deliver developer-ready remediation guidance.
Key Responsibilities
• Conduct manual secure code reviews focused on authentication, authorization, input validation, cryptography, session management, and data exposure
• Run and triage SAST scans using Checkmarx One, SonarQube, Semgrep, Snyk Code, or Fortify
• Analyze data flow from source to sink to confirm exploitability and eliminate false positives
• Perform SCA reviews of third-party dependencies and assess reachability of known CVEs
• Map findings to CWE and OWASP Top 10 / OWASP API Security Top 10 with justified severity
• Detect hardcoded secrets, credentials, and insecure configuration in source and IaC files
• Write findings with vulnerable code snippet, exploit scenario, and secure code fix example
• Support SAST integration into CI/CD pipelines (Jenkins, GitLab CI, GitHub Actions, Azure DevOps) and help define quality gates
• Work with development teams on remediation, verification, and closure rationale
• Contribute to custom rule/query tuning to reduce noise
Required Skills
• Ability to read and reason about code in at least two of: Java, C#, Python, JavaScript/TypeScript, PHP, Go, Kotlin/Swift
• Understanding of common vulnerability classes at the code level: SQLi, XSS, SSRF, IDOR, insecure deserialization, path traversal, XXE, command injection, race conditions
• Familiarity with framework-specific security controls (Spring Security, Django, Express, .NET, Laravel)
• Working knowledge of at least one SAST platform and its triage workflow
• Understanding of CWE taxonomy, CVSS scoring, and secure SDLC principles
• Comfortable with Git and code review platforms
Good to have
Cryptography fundamentals. CTF placements. CEH, eJPT, Security+. A HackTheBox or TryHackMe profile. Bug bounty acknowledgements. CVEs.
Apply
CV to careers@cysigil.com,
subject "Associate Security Analyst (L2) — VAPT". Attach a write-up, a profile, a disclosure — anything you've done. We read that before the CV.
Click on Apply to know more.
