Senior QA Engineer – Automation

Experience: 4+ Years

Job Location: WFH / Hybrid

No. of Positions: Multiple

Qualifications: B.Tech / M.Tech / MCA or equivalent in Computer Science or a related field

Work Timings: 1:30 PM IST to 10:30 PM IST

About the Role

We are looking for a skilled and versatile Senior QA Engineer with hands-on expertise in Web UI Automation, API Testing, and Application Security/Penetration Testing.

In this dual-focus role, you will be responsible for ensuring both the functional excellence and security resilience of modern web applications and microservices. You will build and scale automated test suites while systematically identifying application-level security flaws, running vulnerability scans, and performing manual and automated penetration testing across web and API layers.

Key Responsibilities

Test Automation & API Testing

• Design, build, and maintain scalable automated test suites for web applications using modern UI frameworks (e.g., Playwright, Cypress, Selenium).
• Architect automated end-to-end API test suites for REST and GraphQL services (payload validation, contract testing, response times, auth token flows).
• Perform functional, regression, integration, cross-browser, and database verification testing.
• Embed UI and API automated tests into CI/CD pipelines (GitHub Actions, GitLab CI, Jenkins) for continuous feedback and zero-defect releases.
• Write complex SQL queries to validate backend data integrity and system states.

Security & Penetration Testing

• Conduct vulnerability assessments and web application penetration testing aligned with OWASP Top 10 and OWASP API Security Top 10.
• Execute both dynamic application security testing (DAST) and manual penetration testing to uncover vulnerabilities such as SQL injection, XSS, Broken Object-Level Authorization (BOLA/IDOR), CSRF, and SSRF.
• Perform API security audits focusing on authentication, authorization mechanisms (OAuth 2.0, JWT, API Keys), rate limiting, and parameter tampering.
• Integrate automated security scanning tools (e.g., OWASP ZAP, Burp Suite, Snyk) into the DevSecOps/CI-CD workflow.
• Document security findings, assign severity scores (CVSS), and partner directly with development teams to triage, reproduce, and verify remediation.

Collaboration & Quality Ownership

• Participate actively in Agile ceremonies (Sprint Planning, Standups, Grooming) to ensure early threat modeling and quality planning.
• Analyze system logs and telemetry using tools like Splunk, Datadog, or ELK to conduct root cause analysis (RCA) on functional defects and security alerts.
• Maintain clear technical documentation, test strategies, and security vulnerability reports.

Skills, Knowledge, and Experience

Required Technical Skills

• 4+ years of core QA experience covering functional, regression, API, and automation testing.
• 1–2+ years of practical experience in Security Testing and Web/API Penetration Testing.
• Strong hands-on proficiency in building automation frameworks with tools like Playwright, Cypress, Selenium, or Karate.
• Solid experience in API testing (functional and security) using tools such as Postman, RestAssured, Insomnia, or Karate.
• Proven proficiency with web security assessment tools such as Burp Suite Professional/Community, OWASP ZAP, Nmap, or SQLmap.
• In-depth understanding of OWASP Top 10 and OWASP API Security Top 10 vulnerabilities and remediation strategies.
• Strong command of SQL (PostgreSQL, MySQL, etc.) for data validation and backend verification.
• Solid experience with version control (Git) workflows (branching, pull requests, conflict resolution).
• Working knowledge of CI/CD integration (Jenkins, GitHub Actions, GitLab CI) for running automated tests and automated security scans.