.NET Application Security Audit & Vulnerability Assessment

We are looking for an experienced .NET / ASP.NET Core security specialist to perform a comprehensive security audit of our application. The objective is to identify potential security vulnerabilities across the application code, APIs, dependencies, configuration, authentication and authorization mechanisms, and deployment environment, and provide clear, actionable recommendations for remediation. Responsibilities - Conduct a security assessment of our C# / .NET / ASP.NET Core application - Review application architecture and security controls - Analyze API endpoints, request handling, input validation, and error handling - Identify common application security issues, including: - SQL Injection - Cross-Site Scripting (XSS) - Cross-Site Request Forgery (CSRF) - Authentication and authorization vulnerabilities - Insecure handling or storage of sensitive data - Insufficient input validation and output encoding - Improper error handling and information disclosure - Dependency and NuGet package vulnerabilities - Weak ASP.NET Core or hosting configuration - Review authentication mechanisms, session/token handling, and access-control logic. - Perform static and dynamic security testing where applicable. - Review the application's dependencies and identify known security risks. - Assess security-related configuration in the hosting environment, including Azure if applicable. - Provide a detailed security audit report containing: - Identified vulnerabilities and security weaknesses - Severity and potential impact - Affected components or code areas - Recommended remediation steps - Secure coding and configuration recommendations Requirements - Strong experience with C#, .NET, and ASP.NET Core - Practical experience with application security and vulnerability assessment - Good knowledge of OWASP Top 10 and common web/API security vulnerabilities - Experience with SAST and DAST tools and security testing methodologies - Strong understanding of secure coding practices for C# and ASP.NET Core - Experience reviewing REST APIs and authentication/authorization implementations - Ability to explain security findings clearly and provide practical remediation guidance Nice to Have - Experience with DevSecOps and integrating security checks into CI/CD pipelines - Experience with Azure security and cloud-hosted .NET applications - Penetration testing experience - Familiarity with security tools such as SonarQube, OWASP ZAP, Burp Suite, Snyk, or similar tools - Experience with security standards and frameworks beyond OWASP