Cyber: D&R | Consultant | VAPT

Your work profile:

We are looking for an experienced Assistant Manager - Application & API VAPT with 4-7 years of hands-on penetration testing experience to lead application security assessments, mentor team members, and manage customer engagements. The candidate should possess strong technical expertise in offensive security, application penetration testing, API security testing, and vulnerability management while being capable of driving security initiatives and stakeholder communications.

Responsibilities:

• Lead and perform end-to-end Vulnerability Assessment and Penetration Testing (VAPT) engagements for web applications.
• Lead and perform end-to-end Vulnerability Assessment and Penetration Testing (VAPT) engagements for APIs (REST, SOAP, GraphQL).
• Lead and perform end-to-end Vulnerability Assessment and Penetration Testing (VAPT) engagements for mobile applications (iOS & Android).
• Lead and perform end-to-end Vulnerability Assessment and Penetration Testing (VAPT) engagements for cloud-hosted applications.
• Lead and perform end-to-end Vulnerability Assessment and Penetration Testing (VAPT) engagements for microservices-based architectures.
• Conduct manual penetration testing beyond automated scanner findings.
• Perform threat modeling and attack surface analysis.
• Validate vulnerabilities identified through SAST, DAST, and SCA tools.
• Conduct secure architecture and security design reviews.
• Perform cloud application security assessments on Azure, AWS, and GCP environments.
• Support container and Kubernetes security assessments.

Leadership & Management Responsibilities:

• Manage and lead a team of VAPT consultants and security analysts.
• Review penetration testing reports and ensure quality deliverables.
• Allocate resources and manage multiple assessment engagements.
• Mentor junior team members on offensive security methodologies and best practices.
• Drive remediation discussions with application owners and development teams.
• Participate in customer and executive-level security review meetings.
• Track assessment metrics, remediation status, and risk reduction initiatives.

Core Penetration Testing Skills Required Application Security:

• Strong understanding of OWASP Top 10.
• Strong understanding of OWASP API Security Top 10.
• Strong understanding of MITRE ATT&CK Framework.
• Strong understanding of CWE/SANS Top 25.

Hands-on Exploitation Experience:

• Web application penetration testing.
• API penetration testing.
• Mobile application security testing.
• Authentication and access control testing.
• Session management testing.
• Business logic testing.
• Manual exploitation techniques.
• Source code assisted testing.

Infrastructure Security Knowledge:

• Network penetration testing.
• Active Directory security assessments.
• Internal and external network assessments.
• Cloud security assessments.
• Container security testing.

Key Skills Required:

• 4-7 years of experience in application security and penetration testing.
• Minimum 2 years of experience leading or mentoring security teams.
• Proven experience managing enterprise-scale VAPT programs.
• Excellent report-writing and stakeholder management skills.
• Strong verbal and written communication skills.
• Bachelor's or Master's degree in Computer Science, Information Security, or related field.

Preferred Certifications:

• OSCP (Offensive Security Certified Professional)
• OSWE (Offensive Security Web Expert)
• GWAPT (GIAC Web Application Penetration Tester)
• eWPT / eWPTX / PNPT / CEH / CREST Certifications / CISSP (Preferred for leadership positions)