About this role
Experience: 4+ Years
Job
Location: WFH / Hybrid
No.
of Positions: Multiple
Qualifications: B.Tech / M.Tech /
MCA or equivalent in Computer Science or a related field
Work
Timings: 1:30 PM IST to 10:30 PM IST
About the Role
We
are looking for a skilled and versatile Senior QA Engineer with hands-on expertise
in Web UI Automation, API
Testing, and Application Security/Penetration Testing.
In
this dual-focus role, you will be responsible for
ensuring both the functional excellence and security resilience of modern web
applications and microservices. You will build and scale automated test suites
while systematically identifying application-level security flaws, running
vulnerability scans, and performing manual and automated penetration testing
across web and API layers.
Key Responsibilities
Test Automation & API Testing
- Design, build, and
maintain scalable automated test suites for web applications using modern
UI frameworks (e.g., Playwright, Cypress, Selenium).
- Architect
automated end-to-end API test suites for REST and GraphQL services
(payload validation, contract testing, response times, auth token flows).
- Perform
functional, regression, integration, cross-browser, and database
verification testing.
- Embed UI and API
automated tests into CI/CD pipelines (GitHub Actions, GitLab CI,
Jenkins) for continuous feedback and zero-defect releases.
- Write complex SQL queries to
validate backend data integrity and system states.
Security & Penetration Testing
- Conduct
vulnerability assessments and web application penetration testing aligned
with OWASP Top 10 and OWASP API Security Top 10.
- Execute both
dynamic application security testing (DAST) and manual penetration testing
to uncover vulnerabilities such as SQL injection, XSS, Broken
Object-Level Authorization (BOLA/IDOR), CSRF, and SSRF.
- Perform API
security audits focusing on authentication, authorization mechanisms (OAuth 2.0,
JWT, API Keys), rate limiting, and parameter tampering.
- Integrate
automated security scanning tools (e.g., OWASP ZAP, Burp Suite, Snyk) into the
DevSecOps/CI-CD workflow.
- Document security
findings, assign severity scores (CVSS), and partner directly with
development teams to triage, reproduce, and verify remediation.
Collaboration & Quality Ownership
- Participate
actively in Agile ceremonies (Sprint Planning, Standups,
Grooming) to ensure early threat modeling and quality planning.
- Analyze system
logs and telemetry using tools like Splunk, Datadog, or ELK to conduct root
cause analysis (RCA) on functional defects and security alerts.
- Maintain clear
technical documentation, test strategies, and security vulnerability
reports.
Skills, Knowledge, and Experience
Required Technical Skills
- 4+
years
of core QA experience covering functional, regression, API, and automation
testing.
- 1–2+
years
of practical experience in Security Testing and
Web/API Penetration Testing.
- Strong hands-on
proficiency in building automation frameworks with tools like Playwright,
Cypress, Selenium, or Karate.
- Solid experience
in API testing (functional and security) using tools such as Postman,
RestAssured, Insomnia, or Karate.
- Proven proficiency
with web security assessment tools such as Burp Suite
Professional/Community, OWASP ZAP, Nmap, or SQLmap.
- In-depth
understanding of OWASP Top 10 and OWASP API Security
Top 10 vulnerabilities and remediation strategies.
- Strong command of SQL (PostgreSQL,
MySQL, etc.) for data validation and backend verification.
- Solid experience
with version control (Git) workflows (branching, pull
requests, conflict resolution).
- Working knowledge
of CI/CD integration (Jenkins, GitHub Actions, GitLab CI) for
running automated tests and automated security scans.