Security Compliance professional

Job Title: Security Engineer (VAPT & Remediation)

Location: Pune | Hybrid

Experience: 5-8 Years

Primary Skills: VAPT / Penetration Testing, Web & API Security, Vulnerability Remediation, Cloud & Infrastructure Security

This is a hands-on security engineering role responsible for the complete vulnerability lifecycle-identifying vulnerabilities, validating their impact, implementing remediation, and confirming that fixes are effective. The role involves penetration testing and security reviews across applications, APIs, mobile applications, infrastructure, and cloud environments, along with direct remediation through application code and infrastructure configuration.

• Plan and execute penetration tests across web applications, APIs, mobile applications, thick clients, and supporting infrastructure.
• Review application and infrastructure security covering authentication, authorization, session management, data flows, secrets management, network exposure, and cloud configurations.
• Identify vulnerabilities beyond automated scanners through manual testing, including business logic flaws, chained vulnerabilities, and privilege escalation.
• Execute and tune vulnerability scans across applications, hosts, and cloud environments.
• Triage, deduplicate, and prioritize findings based on exploitability, business impact, and CVSS.
• Track vulnerabilities through remediation and maintain accurate risk status.
• Retest fixes and close findings only after confirming successful remediation.

• Remediate vulnerabilities directly in application code across different languages and frameworks.
• Fix infrastructure and configuration vulnerabilities involving web servers, TLS, cloud IAM, network rules, containers, Kubernetes, IaC, and CI/CD pipelines.
• Apply security patches and upgrades to operating systems, frameworks, libraries, and third-party components.
• Raise pull requests or configuration changes for vulnerabilities owned by other teams and drive them through completion.

• Prepare clear security findings with reproduction steps, evidence, risk ratings, and remediation guidance.
• Communicate security risks and remediation requirements effectively to developers, DevOps teams, and business stakeholders.

• 5+ years of experience in penetration testing, application security, or security engineering with hands-on vulnerability remediation experience.
• Strong understanding of VAPT methodologies, OWASP Top 10, OWASP ASVS, and secure application design.
• Experience with manual penetration testing using Burp Suite Professional.
• Strong knowledge of web and API security, including REST, GraphQL, SOAP, gRPC, OAuth 2.0, OpenID Connect, and JWT.
• Experience identifying injection, authentication/session flaws, IDOR/BOLA, SSRF, deserialization, XXE, race conditions, business logic vulnerabilities, mass assignment, rate limiting, and authorization issues.
• Hands-on mobile security testing across iOS and Android using tools such as Frida, Objection, MobSF, jadx, Ghidra, or Hopper.
• Experience with thick-client security testing, reverse engineering, memory/local storage analysis, DLL hijacking, and client-side trust issues.
• Infrastructure security testing experience using Nmap, Nessus, and Metasploit.
• Working knowledge of Active Directory, Linux, and Windows security hardening.
• Ability to read and modify code in multiple languages, with strong proficiency in at least two of Java, C#/.NET, JavaScript/TypeScript, Python, PHP, Go, Swift, or Kotlin.
• Scripting experience using Python, Bash, or PowerShell.
• Practical experience with Git workflows, pull requests, and code reviews.
• Working knowledge of Nginx, Apache, IIS, TLS, Docker, Kubernetes, Terraform, or CloudFormation.

• VAPT / Penetration Testing
• Web Application Security & OWASP
• API Security
• Burp Suite Professional
• Vulnerability Assessment & Remediation
• Mobile / Thick Client Security Testing
• Infrastructure & Network Security
• Secure Coding & Vulnerability Remediation
• Python / Bash / PowerShell Scripting
• Git & Code Review
• Docker / Kubernetes
• Cloud Security Fundamentals across AWS, Azure, and GCP

• Public security research, CVEs, bug bounty, or CTF experience.
• SAST, DAST, and SCA integration into CI/CD pipelines.
• Experience with security tooling such as Aikido.
• Threat modeling and secure design reviews.
• Knowledge of CIS benchmarks, CSPM, and tools such as Prowler.
• SIEM, log analysis, incident response, and MITRE ATT&CK fundamentals.
• Experience supporting SOC incident triage and detection engineering.
• Knowledge of ISO 27001, SOC 2, and PCI DSS compliance requirements related to vulnerability remediation.

• Security findings are remediated and successfully retested within agreed timelines.
• Development and DevOps teams are supported through hands-on remediation.
• Recurring vulnerability classes reduce through root-cause remediation.
• Cloud misconfigurations and patch exposure windows remain minimal.