Application Security Engineer

About the role

Strivo Labs is looking for an Application Security Engineer to assess and strengthen the security of its applications, APIs and authentication systems. The engineer identifies vulnerabilities, evaluates their severity and business impact, and provides actionable recommendations to reduce security risks and protect sensitive information.

Key responsibilities

• Conduct security assessments of mobile applications, backend services and APIs.
• Perform authorized penetration testing within an agreed scope.
• Assess API security, including authentication, authorization, access controls, input validation and data exposure.
• Review authentication mechanisms, session management, token handling and access revocation.
• Test for broken access control, injection flaws, insecure configurations and authentication weaknesses.
• Evaluate whether users can access information or perform actions beyond their permissions, and the security of data in transit.
• Document vulnerabilities with severity, likelihood, impact and remediation, rate them (e.g. CVSS), and prepare reports for technical and management stakeholders.
• Work with developers and infrastructure teams to validate findings and recommend fixes, then retest to confirm resolution.
• Maintain records of testing activities, findings, evidence and remediation status, always within approved authorization, scope and rules of engagement.

Required profile

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology or a related field, or equivalent practical experience.
• Demonstrable experience in application security, penetration testing, vulnerability assessment or a related security role.
• Strong understanding of web application and API security principles.
• Experience testing REST APIs and mobile application security.
• Familiarity with OWASP Top 10 and secure software development practices.

Required skills

• Knowledge of authentication, authorization, session management and access control.
• Security testing tools such as Burp Suite, OWASP ZAP and Postman.
• Preferred: OWASP API Security Top 10, MASVS, OSCP, GWAPT or CEH; fintech or payment systems experience; encryption and token management knowledge.

Candidates apply by sending their CV to the employer, quoting Application Security Engineer as the subject of the email.