Application Security Engineer (Hybrid)

About this role

Strivo Labs in Lagos is looking for an Application Security Engineer on a contract, hybrid basis. The role focuses on assessing and strengthening the security of the company’s applications, APIs and authentication systems, identifying vulnerabilities and providing remediation recommendations. The engineer will perform security testing, penetration testing within an approved scope, and collaborate with developers and infrastructure teams to validate fixes. Experience with web application and API security, vulnerability assessments, and secure software practices is required. The position targets candidates with hands-on security testing skills and knowledge of OWASP guidelines, with preference for those experienced in fintech or sensitive data environments.

What you would do

• Prepare security assessment reports for technical and management stakeholders.
• Assess API security including authentication, authorization and access controls.
• Collaborate with developers and infrastructure teams to validate findings and fixes.
• Review authentication, session management, token handling and access revocation processes.
• Test for vulnerabilities such as broken access control, injections, insecure configurations, and authentication weaknesses.
• Conduct security assessments of mobile apps, backend services and APIs.
• Rate vulnerabilities using a recognised method (eg CVSS).
• Assess information exposure and ensure proper access controls.
• Perform authorised penetration testing within agreed scope and conduct retesting.
• Document vulnerabilities with severity, likelihood, impact and remediation recommendations.

What they are asking for

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology or related field, or equivalent practical experience.
• Experience in application security, penetration testing or vulnerability assessment.
• Understanding of web application and API security principles and OWASP Top 10.
• Experience with security testing tools such as Burp Suite, OWASP ZAP, Postman or similar.
• Strong analytical, writing and problem-solving skills.
• Experience testing REST APIs and mobile app security.
• Good communication and collaboration abilities.

Listing details are summarised from the source. Always confirm the role and the employer on the original posting before applying, and never pay to apply for a job.