Job Title:  T&T | Cyber: D&R | Consultant | Vulnerability Assessment & Penetration Testing (VAPT) | Bengaluru

The team  

Deloitte helps organizations prevent cyberattacks and protect valuable assets. We believe in being secure, vigilant, and resilient—not only by looking at how to prevent and respond to attacks, but at how to manage cyber risk in a way that allows you to unleash new opportunities. Embed cyber risk at the start of strategy development for more effective management of information and technology risks. Learn more about Cybersecurity  

Your work profile

• Perform Vulnerability Assessments and Penetration Testing (VAPT) on web applications, mobile applications, APIs, and microservices.
• Conduct security testing aligned with OWASP Top 10, OWASP API Security Top 10, SANS Top 25, and CWE standards.
• Identify, exploit, and validate security vulnerabilities such as:
• Authentication and Authorization flaws
• SQL Injection
• Cross-Site Scripting (XSS)
• Server-Side Request Forgery (SSRF)
• Insecure Direct Object References (IDOR)
• Cross-Site Request Forgery (CSRF)
• Remote Code Execution (RCE)
• Business Logic Vulnerabilities
• API-specific vulnerabilities
• Perform manual security testing in addition to automated scanning.
• Review source code findings and validate security weaknesses where applicable.
• Assess REST, SOAP, GraphQL, and microservice-based APIs.
• Prepare detailed VAPT reports with risk ratings, proof of concepts, and remediation recommendations.
• Conduct remediation validation and re-testing of identified vulnerabilities.
• Collaborate with development, DevOps, and architecture teams to drive security improvements.
• Support secure SDLC activities and DevSecOps initiatives.
• Participate in threat modeling and security design reviews.
• Provide security guidance and awareness to application development teams.

Key Skills Required:

• 3-5 years of hands-on experience in Application Security and VAPT.
• Strong understanding of:
• OWASP Top 10, OWASP API Security Top 10, HTTP/HTTPS protocols
• Authentication mechanisms (OAuth 2.0, JWT, SAML, OpenID Connect)
• Session Management and Access Controls
• Hands-on experience with tools such as:
• Burp Suite Professional, OWASP ZAP, Postman, Nmap
• Nessus, Acunetix, Nikto, SQLMap, Metasploit
• Experience testing APIs, Single Page Applications (SPA), and cloud-native applications.
• Familiarity with CI/CD and DevSecOps practices.
• Basic understanding of AWS, Azure, or GCP security concepts.
• Ability to analyze application architecture and identify attack vectors.
• Preferred Qualifications:CEH (Certified Ethical Hacker)
• eWPT (eLearnSecurity Web Application Penetration Tester)
• GWAPT (GIAC Web Application Penetration Tester)
• OSCP (Offensive Security Certified Professional)
• PNPT or equivalent offensive security certifications
• Knowledge of secure coding practices and code review methodologies.
• Experience with SAST, DAST, SCA, and Container Security tools.
• Exposure to Kubernetes, Docker, and Cloud Security assessments.
• Experience supporting large enterprise vulnerability management programs.
• Bachelor's or Master's degree in Computer Science, Information Security, Cybersecurity, or related field