Job Title:  T&T | Cyber: D&R | Deputy Manager | Vulnerability Assessment & Penetration Testing | Bengaluru

The team  

Deloitte helps organizations prevent cyberattacks and protect valuable assets. We believe in being secure, vigilant, and resilient—not only by looking at how to prevent and respond to attacks, but at how to manage cyber risk in a way that allows you to unleash new opportunities. Embed cyber risk at the start of strategy development for more effective management of information and technology risks. Learn more about Cybersecurity  

Your work profile 

We are seeking a highly motivated and skilled Application & API VAPT (Vulnerability Assessment and Penetration Testing) Analyst with 3 to 5 years of experience in identifying, assessing, and validating security vulnerabilities across web applications, mobile applications, APIs, and cloud-hosted applications. The candidate will be responsible for conducting security assessments, supporting remediation efforts, and helping enhance the organization's security posture.

• Perform Vulnerability Assessments and Penetration Testing (VAPT) on web applications, mobile applications, APIs, and microservices.
• Conduct security testing aligned with OWASP Top 10, OWASP API Security Top 10, SANS Top 25, and CWE standards.
• Experience of Web Application Security Testing, Infrastructure VAPT, API testing.
• Understanding of AI/LLM concepts, Generative AI applications, and common AI application architectures.
• Experience in working on multiple Cyber Security Strategy including strategy and program/process development, maturity assessment, roadmap, training and awareness programs. Cyber security programs includes Secure Development Lifecycle, Cyber Security Strategy Maturity and Program Assessment, Vulnerability Management Lifecycle, Cyber Security Governance.
• Demonstrates understanding of complex business and information technology management processes
• Interacts with clients, managers and partners to build and nurture strong relationships
• Tailors firm tools and methodologies as per client requirements.

Key Skills Required:

• Experience of Web Application Security Testing, Infrastructure VAPT, API testing, Mobile Testing (iOS & Android). 
• Experience in conducting security assessments and penetration testing of Generative AI applications, LLM-based solutions, AI-powered chatbots, and RAG (Retrieval-Augmented Generation) architectures.
• Strong understanding of AI/LLM-specific vulnerabilities, including Prompt Injection, Jailbreaking, Sensitive Information Disclosure, System Prompt Leakage, Insecure Output Handling, and Excessive Agency, aligned with OWASP Top 10 for LLM Applications.
• Experience in assessing AI guardrails, model access controls, retrieval mechanisms, vector databases, and integrations with external tools, APIs, and enterprise systems.
• Ability to lead technical AI penetration testing activities, develop scenario-based test cases, validate exploitability, assess business impact, and recommend risk-based remediation strategies.
• Knowledge of AI security testing methodologies, LLM application threat modelling, adversarial testing, and responsible assessment of AI model behaviors and security controls.
• Experience in evaluating AI application security across the development lifecycle, including secure AI architecture, DevSecOps integration, and security validation of AI-enabled solutions.
• Ability to prepare AI security assessment reports, communicate technical findings and business risks to stakeholders, and support clients in defining remediation roadmaps.
• Experience on Cloud (AWS & Azure) Configuration Review and Pentest.
• Experience in conducting Firewall and Network Devices Configuration Review and configuration reviews of Windows, Linux, UNIX, Solaris, Databases, etc.
• Good Experience in Red Teaming, Thick Client and Source Code Review.
• Hands on experience on DevSecOps.
• Experience as an Security Architect.
• Experience on End Point Security and Product Security.
• Experience with Vulnerability Management tools: Burp, Kali Linux, Acunetix, AppScan, Nexpose, Qualys Guard, Nessus, Nmap, Metasploit, Fortify etc.
• Bachelor's or Master's degree in Computer Science, Information Security, Cybersecurity, or related field.
• Professional is required to work from office .
• Preferred Certifications : OSCP (Offensive Security Certified Professional)
• OSWE (Offensive Security Web Expert)
• GWAPT (GIAC Web Application Penetration Tester)
• eWPT / eWPTX / PNPT / CEH /CREST Certifications/ CISSP (Preferred for leadership positions)