Application Security & Infra VAPT - Penetration Tester

About the Role Key Responsibilities

• Perform Application Security Testing and Infrastructure VAPT based on defined methodologies and industry standards.
• Conduct Web, API and Mobile Application Security Testing.
• Perform infrastructure VAPT across servers, networks, firewalls, endpoints and related components.
• Identify, validate and assess security vulnerabilities and misconfigurations.
• Analyze authentication, authorization, access control, session management, business logic and API security.
• Conduct Secure Code Review (SCR) and identify insecure coding practices where applicable.
• Perform vulnerability retesting and remediation validation.
• Prepare detailed security assessment and VAPT reports with evidence, impact, risk ratings and remediation recommendations.
• Work closely with development, infrastructure, application and customer teams to address security findings.
• Support security assessments for BFSI, banking, UPI and payment applications.
• Support PCI-DSS and other security compliance assessments.
• Participate in client discussions, technical walkthroughs and security review meetings.
• Maintain assessment documentation and ensure timely completion of assigned deliverables.

Application Security - Required Skills

• 2+ years of hands-on experience in Application Security / AppSec / VAPT.
• Strong understanding of OWASP Top 10 and application security fundamentals.
• Hands-on experience in Web and API Security Testing.
• Exposure to Mobile Application Security Testing is preferred.
• Understanding of JWT, OAuth, authentication, authorization and business logic vulnerabilities.
• Hands-on experience with tools such as Burp Suite, Postman and OWASP ZAP.
• Experience with MobSF, Frida or Objection is an advantage.
• Basic understanding of programming languages such as Java, Python, .NET or equivalent.
• Secure Code Review experience is an advantage.

Infrastructure VAPT - Required Skills

• 2+ years of hands-on experience in Infrastructure VAPT / Penetration Testing.
• Strong understanding of TCP/IP, DNS, routing, switching and firewalls.
• Experience assessing servers, networks, endpoints and infrastructure components.
• Knowledge of common infrastructure vulnerabilities, misconfigurations and attack vectors.
• Hands-on experience with tools such as Nmap, Nessus, Wireshark or similar.
• Ability to validate vulnerabilities and provide practical remediation recommendations.
• Strong report writing and technical documentation skills.

BFSI Compliance Exposure

• Banking / BFSI environments
• UPI and payment applications
• PCI-DSS assessments
• Security compliance audits
• Client-facing security assessment engagements

Team Coordination Client Interaction

• Coordinate with junior security testers and support task allocation where required.
• Review vulnerability findings and security reports for technical accuracy.
• Mentor junior team members on security testing methodologies and vulnerability validation.
• Coordinate with developers, infrastructure teams, application owners and client stakeholders.
• Track remediation, retesting and closure of identified vulnerabilities.
• Participate in client meetings and explain technical findings and remediation requirements.

Preferred Certifications

• CEH
• eWPT / eMAPT
• OSCP / OSWE
• CREST or equivalent
• CCNA for Infrastructure VAPT profiles

Qualification

• Bachelors degree in Computer Science, Information Technology, Cybersecurity or an equivalent field.
• 2+ years of relevant cybersecurity experience.
• Immediate joiners are preferred.
• Candidates serving a notice period may also be considered based on the requirement.
• Strong analytical and problem-solving skills.
• Excellent technical documentation and communication skills.
• Ability to work in a structured, client-facing and compliance-driven environment.
• Willingness to travel to customer locations as required.

Important Instructions

• Candidates must upload their educational and relevant qualification documents under Additional Documents in HRMS.
• Candidates should be comfortable working from the Andheri/Dombivli office and customer locations as required.