Job Title:  T&T | Cyber: D&R | Consultant | Vulnerability Management and Penetration testing | Bengaluru

The team  

Deloitte helps organizations prevent cyberattacks and protect valuable assets. We believe in being secure, vigilant, and resilient—not only by looking at how to prevent and respond to attacks, but at how to manage cyber risk in a way that allows you to unleash new opportunities. Embed cyber risk at the start of strategy development for more effective management of information and technology risks. Learn more about Cybersecurity  

Your work profile 

We are seeking a highly motivated and skilled Application & API VAPT (Vulnerability Assessment and Penetration Testing) Analyst with 3 to 5 years of experience in identifying, assessing, and validating security vulnerabilities across web applications, mobile applications, APIs, and cloud-hosted applications. The candidate will be responsible for conducting security assessments, supporting remediation efforts, and helping enhance the organization's security posture.

• Lead vulnerability reduction activities under the Mythos Readiness Program, focusing on the identification and remediation of vulnerabilities.
• Perform vulnerability triage, validation, risk assessment, remediation tracking, and closure management using Wiz, Wiz Red Agent, Qualys VMDR, and Qualys WAS.
• Develop and maintain automation scripts, reporting dashboards, and operational workflows to improve vulnerability visibility, prioritization, and program reporting.

Key Skills Required:

• 2-5 years of hands-on experience in Application Security and VAPT.
• Experience with Vulnerability Management and Penetration testing tools: Burp suite, Kali Linux, Acunetix, AppScan, Nexpose, Qualys Guard, Nessus, Nmap, Metasploit, Fortify etc. Tenable WAS, Tenable.sc, VMDR.
• Develop and maintain automation scripts, reporting dashboards, and operational workflows to improve vulnerability visibility, prioritization, and program reporting.
• Leverage strong understanding of Cloud Security and Container Security to assess risks across cloud-native environments, containerized workloads, Kubernetes platforms, and internet-facing services.
• Provide actionable remediation recommendations to application, infrastructure, cloud, and platform teams, ensuring timely mitigation of critical security exposures.
• Manage client and stakeholder communications, including status reporting, risk discussions, remediation reviews, and escalation management.
• Operate effectively in a fast-paced environment with strict remediation timelines, driving adherence to P0 remediation SLAs and rapid issue resolution.
• Bachelor’s or Master’s degree in Computer Science, Information Security, or related field. 
• Preferred Certifications : OSCP (Offensive Security Certified Professional)
• OSWE (Offensive Security Web Expert)
• GWAPT (GIAC Web Application Penetration Tester)
• eWPT / eWPTX / PNPT / CEH /CREST Certifications/ CISSP (Preferred for leadership positions)