Job Title: T&T | Cyber: D&R | Consultant | VAPT | Bengaluru
Position: Application & API VAPT Analyst
Experience: 3-5 Years
Skillset : Offensive Security
Role Overview
We are seeking a highly motivated and skilled Application & API VAPT (Vulnerability Assessment and Penetration Testing) Analyst with 3 to 5 years of experience in identifying, assessing, and validating security vulnerabilities across web applications, mobile applications, APIs, and cloud-hosted applications. The candidate will be responsible for conducting security assessments, supporting remediation efforts, and helping enhance the organization's security posture.
Key Responsibilities
- Perform Vulnerability Assessments and Penetration Testing (VAPT) on web applications, mobile applications, APIs, and microservices.
- Conduct security testing aligned with OWASP Top 10, OWASP API Security Top 10, SANS Top 25, and CWE standards.
- Identify, exploit, and validate security vulnerabilities such as:
- Authentication and Authorization flaws
- SQL Injection
- Cross-Site Scripting (XSS)
- Server-Side Request Forgery (SSRF)
- Insecure Direct Object References (IDOR)
- Cross-Site Request Forgery (CSRF)
- Remote Code Execution (RCE)
- Business Logic Vulnerabilities
- API-specific vulnerabilities
- Perform manual security testing in addition to automated scanning.
- Review source code findings and validate security weaknesses where applicable.
- Assess REST, SOAP, GraphQL, and microservice-based APIs.
- Prepare detailed VAPT reports with risk ratings, proof of concepts, and remediation recommendations.
- Conduct remediation validation and re-testing of identified vulnerabilities.
- Collaborate with development, DevOps, and architecture teams to drive security improvements.
- Support secure SDLC activities and DevSecOps initiatives.
- Participate in threat modeling and security design reviews.
- Provide security guidance and awareness to application development teams.
Required Skills & Experience
Technical Skills
- 3-5 years of hands-on experience in Application Security and VAPT.
- Strong understanding of:
- OWASP Top 10
- OWASP API Security Top 10
- HTTP/HTTPS protocols
- Authentication mechanisms (OAuth 2.0, JWT, SAML, OpenID Connect)
- Session Management and Access Controls
- Hands-on experience with tools such as:
- Burp Suite Professional
- OWASP ZAP
- Postman
- Nmap
- Nessus
- Acunetix
- Nikto
- SQLMap
- Metasploit
- Experience testing APIs, Single Page Applications (SPA), and cloud-native applications.
- Familiarity with CI/CD and DevSecOps practices.
- Basic understanding of AWS, Azure, or GCP security concepts.
- Ability to analyze application architecture and identify attack vectors.
Preferred Qualifications
- CEH (Certified Ethical Hacker)
- eWPT (eLearnSecurity Web Application Penetration Tester)
- GWAPT (GIAC Web Application Penetration Tester)
- OSCP (Offensive Security Certified Professional)
- PNPT or equivalent offensive security certifications
- Knowledge of secure coding practices and code review methodologies
Educational Qualifications
- Bachelor's degree in Computer Science, Information Security, Cybersecurity, or related field.
- Relevant cybersecurity certifications preferred.
Key Competencies
- Strong analytical and problem-solving skills
- Excellent report-writing and communication skills
- Ability to work independently and manage multiple assessments
- Stakeholder management and presentation skills
- Attention to detail and risk-based thinking
Nice to Have
- Experience with SAST, DAST, SCA, and Container Security tools.
- Exposure to Kubernetes, Docker, and Cloud Security assessments.
- Experience supporting large enterprise vulnerability management programs.