T&T | Cyber: D&R | Consultant | VAPT | Bengaluru

The team

Deloitte helps organizations prevent cyberattacks and protect valuable assets. We believe in being secure, vigilant, and resilient—not only by looking at how to prevent and respond to attacks, but at how to manage cyber risk in a way that allows you to unleash new opportunities. Embed cyber risk at the start of strategy development for more effective management of information and technology risks. Learn more about Cybersecurity

Your work profile

We are looking for an experienced Assistant Manager - Application & API VAPT with 4-7 years of hands-on penetration testing experience to lead application security assessments, mentor team members, and manage customer engagements. The candidate should possess strong technical expertise in offensive security, application penetration testing, API security testing, and vulnerability management while being capable of driving security initiatives and stakeholder communications.

• Lead and perform end-to-end Vulnerability Assessment and Penetration Testing (VAPT) engagements for:
• Web Applications
• APIs (REST, SOAP, GraphQL)
• Mobile Applications (iOS & Android)
• Cloud-hosted Applications
• Microservices-based Architectures
• Execute advanced penetration testing techniques to identify and exploit:
• Conduct manual penetration testing beyond automated scanner findings.
• Perform threat modeling and attack surface analysis.
• Validate vulnerabilities identified through SAST, DAST, and SCA tools.
• Conduct secure architecture and security design reviews.
• Perform cloud application security assessments on Azure, AWS, and GCP environments.
• Support container and Kubernetes security assessments.

• Manage and lead a team of VAPT consultants and security analysts.
• Review penetration testing reports and ensure quality deliverables.
• Allocate resources and manage multiple assessment engagements.
• Mentor junior team members on offensive security methodologies and best practices.
• Drive remediation discussions with application owners and development teams.
• Participate in customer and executive-level security review meetings.
• Track assessment metrics, remediation status, and risk reduction initiatives.

Application Security

• Strong understanding of:
• OWASP Top 10
• OWASP API Security Top 10
• MITRE ATT&CK Framework
• CWE/SANS Top 25

Hands-on Exploitation Experience

• Web Application Penetration Testing
• API Penetration Testing
• Mobile Application Security Testing
• Authentication and Access Control Testing
• Session Management Testing
• Business Logic Testing
• Manual Exploitation Techniques
• Source Code Assisted Testing

Infrastructure Security Knowledge

• Network Penetration Testing
• Active Directory Security Assessments
• Internal and External Network Assessments
• Cloud Security Assessments
• Container Security Testing

Key Skills Required:

• 4-7 years of experience in Application Security and Penetration Testing.
• Minimum 2 years of experience leading or mentoring security teams.
• Proven experience managing enterprise-scale VAPT programs.
• Excellent report-writing and stakeholder management skills.
• Strong verbal and written communication skills.
• Bachelor’s or Master’s degree in Computer Science, Information Security, or related field.
• Preferred Certifications : OSCP (Offensive Security Certified Professional)
• OSWE (Offensive Security Web Expert)
• GWAPT (GIAC Web Application Penetration Tester)
• eWPT / eWPTX / PNPT / CEH /CREST Certifications/ CISSP (Preferred for leadership positions)