Application Security Engineer

Strivo Labs

Job Title: Application Security Engineer Location: Lagos Job Type: Contract (Hybrid)

Job Summary

• We are seeking a competent Application Security Engineer to assess and strengthen the security of our applications, APIs, and authentication systems.
• The ideal candidate will have practical experience in application security testing, authorized penetration testing, vulnerability assessment, access control reviews, and session management.
• The successful candidate will identify security vulnerabilities, evaluate their severity and potential business impact, and provide actionable recommendations to reduce security risks and protect sensitive information.

Key Responsibilities

• Conduct security assessments of mobile applications, backend services, and APIs.

• Perform authorized penetration testing within an agreed scope to identify exploitable vulnerabilities.

• Assess API security, including authentication, authorization, access controls, input validation, and data exposure.

• Review authentication mechanisms, session management, token handling, and access revocation processes.

• Test for common application security vulnerabilities, including broken access control, injection flaws, insecure configurations, and authentication weaknesses.

• Assess whether users can access information or perform actions beyond their assigned permissions.

• Evaluate the security of sensitive data transmitted between applications, APIs, and backend services.

• Identify and document vulnerabilities, including their severity, likelihood, potential impact, and recommended remediation.

• Rate vulnerabilities using an established methodology, such as the Common Vulnerability Scoring System (CVSS), where appropriate.

• Prepare comprehensive security assessment reports for technical and management stakeholders.

• Work with developers and infrastructure teams to validate findings and recommend appropriate fixes.

• Conduct retesting to confirm that identified vulnerabilities have been resolved.

• Maintain clear records of testing activities, findings, evidence, and remediation status.

• Ensure all security testing is conducted within approved authorization, scope, and rules of engagement.

• Requirements and Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related field, or equivalent practical experience.

• Demonstrable experience in application security, penetration testing, vulnerability assessment, or a related security role.

• Strong understanding of web application and API security principles.

• Experience testing REST APIs and mobile application security.

• Knowledge of authentication, authorization, session management, and access control mechanisms.

• Familiarity with common application security vulnerabilities and the OWASP Top 10.

• Experience using security testing tools such as Burp Suite, OWASP ZAP, Postman, or comparable tools.

• Ability to identify, reproduce, document, and assess security vulnerabilities.

• Strong understanding of secure software development practices and vulnerability remediation.

• Excellent analytical, technical writing, and problem-solving skills.

Preferred Skills:

• Familiarity with OWASP API Security Top 10 and OWASP Mobile Application Security Verification Standard (MASVS).
• Relevant certifications such as OSCP, GWAPT, CEH, or equivalent practical security testing credentials.
• Experience with fintech, payment systems, financial applications, or platforms handling sensitive customer information.
• Knowledge of encryption, cryptographic implementation risks, and secure token management.
• Experience conducting risk-based security assessments and presenting findings to technical and non-technical stakeholders.

Key Competencies:

• Strong security analysis and investigative skills
• High ethical standards and respect for confidentiality
• Attention to detail and evidence-based reporting.
• Ability to prioritize vulnerabilities according to risk.
• Effective communication and collaboration.
• Practical, solution-oriented problem-solving.

Application Closing Date

Not Specified.