Application Security Engineer

At Strivo Labs, we are passionate about helping businesses scale with speed and precision. We specialise in providing end-to-end digital solutions, from custom design and MVP development to automation and content creation. We are recruiting to fill position below:

Job Title: Application Security Engineer

Location: Lagos

Job Summary

We are seeking a competent Application Security Engineer to assess and strengthen the security of our applications, APIs, and authentication systems. The ideal candidate will have practical experience in application security testing, authorized penetration testing, vulnerability assessment, access control reviews, and session management. The successful candidate will identify security vulnerabilities, evaluate their severity and potential business impact, and provide actionable recommendations to reduce security risks and protect sensitive information.

Key Responsibilities

Conduct security assessments of mobile applications, backend services, and APIs. Perform authorized penetration testing within an agreed scope to identify exploitable vulnerabilities. Assess API security, including authentication, authorization, access controls, input validation, and data exposure. Review authentication mechanisms, session management, token handling, and access revocation processes. Test for common application security vulnerabilities, including broken access control, injection flaws, insecure configurations, and authentication weaknesses. Assess whether users can access information or perform actions beyond their assigned permissions. Evaluate the security of sensitive data transmitted between applications, APIs, and backend services. Identify and document vulnerabilities, including their severity, likelihood, potential impact, and recommended remediation. Rate vulnerabilities using an established methodology, such as the Common Vulnerability Scoring System (CVSS), where appropriate. Prepare comprehensive security assessment reports for technical and management stakeholders. Work with developers and infrastructure teams to validate findings and recommend appropriate fixes. Conduct retesting to confirm that identified vulnerabilities have been resolved. Maintain clear records of testing activities, findings, evidence, and remediation status. Ensure all security testing is conducted within approved authorization, scope, and rules of engagement.