Job Title:  T&T | Cyber: D&R | Consultant | Application & API Security (VAPT) | Bengaluru

The team  

Deloitte helps organizations prevent cyberattacks and protect valuable assets. We believe in being secure, vigilant, and resilient—not only by looking at how to prevent and respond to attacks, but at how to manage cyber risk in a way that allows you to unleash new opportunities. Embed cyber risk at the start of strategy development for more effective management of information and technology risks. Learn more about Cybersecurity  

Your work profile 

We are seeking a highly motivated and skilled Application & API VAPT (Vulnerability Assessment and Penetration Testing) Analyst with 3 to 5 years of experience in identifying, assessing, and validating security vulnerabilities across web applications, mobile applications, APIs, and cloud-hosted applications. The candidate will be responsible for conducting security assessments, supporting remediation efforts, and helping enhance the organization's security posture.

• Perform Vulnerability Assessments and Penetration Testing (VAPT) on web applications, mobile applications, APIs, and microservices.
• Conduct security testing aligned with OWASP Top 10, OWASP API Security Top 10, SANS Top 25, and CWE standards.
• Identify, exploit, and validate security vulnerabilities such as:
• Authentication and Authorization flaws
• SQL Injection
• Cross-Site Scripting (XSS)
• Server-Side Request Forgery (SSRF)
• Insecure Direct Object References (IDOR)
• Cross-Site Request Forgery (CSRF)
• Remote Code Execution (RCE)
• Business Logic Vulnerabilities
• API-specific vulnerabilities
• Perform manual security testing in addition to automated scanning.
• Review source code findings and validate security weaknesses where applicable.
• Assess REST, SOAP, GraphQL, and microservice-based APIs.
• Prepare detailed VAPT reports with risk ratings, proof of concepts, and remediation recommendations.
• Conduct remediation validation and re-testing of identified vulnerabilities.
• Collaborate with development, DevOps, and architecture teams to drive security improvements.
• Support secure SDLC activities and DevSecOps initiatives.
• Participate in threat modeling and security design reviews.
• Provide security guidance and awareness to application development teams.

Key Skills Required:

• 2-5 years of hands-on experience in Application Security and VAPT.
• Strong understanding of:
• OWASP Top 10
• OWASP API Security Top 10
• HTTP/HTTPS protocols
• Authentication mechanisms (OAuth 2.0, JWT, SAML, OpenID Connect)
• Session Management and Access Controls
• Hands-on experience with tools such as:
• Burp Suite Professional
• OWASP ZAP
• Postman
• Nmap
• Nessus
• Acunetix
• Nikto
• SQLMap
• Metasploit
• Experience testing APIs, Single Page Applications (SPA), and cloud-native applications.
• Familiarity with CI/CD and DevSecOps practices.
• Basic understanding of AWS, Azure, or GCP security concepts.
• Ability to analyze application architecture and identify attack vectors.
• CEH (Certified Ethical Hacker)
• eWPT (eLearnSecurity Web Application Penetration Tester)
• GWAPT (GIAC Web Application Penetration Tester)
• OSCP (Offensive Security Certified Professional)
• PNPT or equivalent offensive security certifications
• Knowledge of secure coding practices and code review methodologies
• Bachelor's or Master's degree in Computer Science, Information Security, Cybersecurity, or related field.
• Relevant cybersecurity certifications preferred.
• Professional is required to work from office