Headline

Security Test Engineer @ Wizzybox · Android & Mobile Application Security | VAPT / Penetration Testing · Product Security Testing | Frida · APK Reverse Engineering · API Security | Bengaluru

About

Security Test Engineer working across product and mobile application security, with API and web application security testing alongside. Across 100+ production Android APK security assessments for a banking and financial services client, I've covered static analysis, APK reverse engineering, dynamic analysis, and Frida-based runtime instrumentation — mapped to the OWASP MASVS / MASTG and Mobile Top 10. I own the full VAPT / penetration testing lifecycle: testing the application to identify and validate security vulnerabilities, sharing findings with the development team for remediation, retesting and cross-checking once fixes are implemented to verify vulnerabilities are properly resolved, and preparing the final CVSS-rated security assessment report for stakeholders once all findings are closed. My core edge is runtime work: custom Frida instrumentation (with Objection) across 60+ production applications to bypass SSL pinning, root and emulator detection, certificate validation, and anti-hooking controls — enabling full runtime and API traffic analysis on hardened apps. Exported-component and IPC testing with Drozer; dynamic testing on Genymotion and physical devices; reverse engineering with JADX and Apktool. Alongside mobile, I run OWASP Top 10 and OWASP API Security Top 10 testing on the banking backends — BOLA/IDOR, broken access control, authentication and authorization, injection, and session security with Burp Suite. Every finding is manually validated and delivered as a CVSS-rated report (50+ so far) with PoC steps, CWE classification, and remediation guidance — then driven to closure with 10+ development teams through triage, retesting, and formal sign-off. Progressed from Security Test Engineer Intern to full-time Security Test Engineer based on performance and technical delivery. Focus: Security Test Engineer · Android & Mobile Application Security · VAPT / Penetration Testing · Product Security Testing · Frida / Objection / Drozer · APK Reverse Engineering · API Security · OWASP MASVS. Open to Security Test Engineer, Android Security, Mobile Application Security, Application Security, VAPT / Penetration Testing, and API Security roles in Bengaluru (on-site / hybrid) or remote from Bengaluru. 90-day notice period. Happy to hear from recruiters and security teams.

Location

Bengaluru

AI stack

claude code

ChatGPT

Work experience

Security Test Engineer at WizzyBox Private Limited, Jan 2026 - Present · 9 mos, Bengaluru, Karnataka, India, • Progressed from Security Test Engineer Intern to full-time Security Test Engineer based on performance and technical delivery. • Conducted security assessments across 100+ production banking Android APKs, covering static analysis, APK reverse engineering, dynamic testing, runtime security controls, API security and remediation validation. • Developed and used custom Frida instrumentation, with Objection, across 60+ applications to test SSL pinning, root and emulator detection, certificate validation, runtime behavior and application security controls. • Performed APK reverse engineering using JADX and Apktool to review application logic, Android components, security configurations, hardcoded secrets, data storage and cryptographic implementations; assessed exported components and IPC surface with Drozer. • Used MobSF, Burp Suite and manual testing to identify mobile and API security issues including broken access control, BOLA/IDOR, authentication weaknesses, insecure data handling and injection vulnerabilities. • Tested Android security controls including root detection, debugging controls, emulator detection, proxy/VPN detection, screen protection, app integrity, installation-source validation and anti-hooking protections. • Authored 50+ CVSS-rated vulnerability reports with technical evidence, PoC steps, CWE classification, impact analysis and remediation recommendations. • Worked with 10+ development teams through vulnerability triage, remediation discussions, retesting and security closure. • Conducted web application VAPT using Burp Suite and OWASP ZAP, testing OWASP Top 10 vulnerabilities including SQL injection, XSS, XXE, CSRF, file upload issues, command injection, broken access control and authentication weaknesses.

Security Test Engineer Intern at WizzyBox Private Limited, Apr 2025 - Aug 2025 · 5 mos, Bengaluru, Karnataka, India, • Performed Android application security testing using MobSF, JADX, Apktool and Burp Suite, covering static analysis, application configuration and security controls. • Identified issues including insecure data storage, hardcoded credentials, exported Android components and misconfigured broadcast receivers, and documented findings with remediation recommendations. • Supported vulnerability verification and security testing activities before transitioning to a full-time Security Test Engineer role.

Education

Bachelor of Engineering, Computer Science and Engineering, maharaja Institute of technology