T&T | Cyber: D&R | Consultant | VAPT | Bengaluru

Position: Application & API VAPT Analyst

Experience: 3-5 Years

Skillset : Offensive Security

Role Overview

We are seeking a highly motivated and skilled Application & API VAPT (Vulnerability Assessment and Penetration Testing) Analyst with 3 to 5 years of experience in identifying, assessing, and validating security vulnerabilities across web applications, mobile applications, APIs, and cloud-hosted applications. The candidate will be responsible for conducting security assessments, supporting remediation efforts, and helping enhance the organization's security posture.

Key Responsibilities

• Perform Vulnerability Assessments and Penetration Testing (VAPT) on web applications, mobile applications, APIs, and microservices.
• Conduct security testing aligned with OWASP Top 10, OWASP API Security Top 10, SANS Top 25, and CWE standards.
• Identify, exploit, and validate security vulnerabilities such as:
• Authentication and Authorization flaws
• SQL Injection
• Cross-Site Scripting (XSS)
• Server-Side Request Forgery (SSRF)
• Insecure Direct Object References (IDOR)
• Cross-Site Request Forgery (CSRF)
• Remote Code Execution (RCE)
• Business Logic Vulnerabilities
• API-specific vulnerabilities
• Perform manual security testing in addition to automated scanning.
• Review source code findings and validate security weaknesses where applicable.
• Assess REST, SOAP, GraphQL, and microservice-based APIs.
• Prepare detailed VAPT reports with risk ratings, proof of concepts, and remediation recommendations.
• Conduct remediation validation and re-testing of identified vulnerabilities.
• Collaborate with development, DevOps, and architecture teams to drive security improvements.
• Support secure SDLC activities and DevSecOps initiatives.
• Participate in threat modeling and security design reviews.
• Provide security guidance and awareness to application development teams.

Required Skills & Experience

Technical Skills

• 3-5 years of hands-on experience in Application Security and VAPT.
• Strong understanding of:
• OWASP Top 10
• OWASP API Security Top 10
• HTTP/HTTPS protocols
• Authentication mechanisms (OAuth 2.0, JWT, SAML, OpenID Connect)
• Session Management and Access Controls
• Hands-on experience with tools such as:
• Burp Suite Professional
• OWASP ZAP
• Postman
• Nmap
• Nessus
• Acunetix
• Nikto
• SQLMap
• Metasploit
• Experience testing APIs, Single Page Applications (SPA), and cloud-native applications.
• Familiarity with CI/CD and DevSecOps practices.
• Basic understanding of AWS, Azure, or GCP security concepts.
• Ability to analyze application architecture and identify attack vectors.

Preferred Qualifications

• CEH (Certified Ethical Hacker)
• eWPT (eLearnSecurity Web Application Penetration Tester)
• GWAPT (GIAC Web Application Penetration Tester)
• OSCP (Offensive Security Certified Professional)
• PNPT or equivalent offensive security certifications
• Knowledge of secure coding practices and code review methodologies

Educational Qualifications

• Bachelor's degree in Computer Science, Information Security, Cybersecurity, or related field.
• Relevant cybersecurity certifications preferred.

Key Competencies

• Strong analytical and problem-solving skills
• Excellent report-writing and communication skills
• Ability to work independently and manage multiple assessments
• Stakeholder management and presentation skills
• Attention to detail and risk-based thinking

Nice to Have

• Experience with SAST, DAST, SCA, and Container Security tools.
• Exposure to Kubernetes, Docker, and Cloud Security assessments.
• Experience supporting large enterprise vulnerability management programs.