T&T | Cyber: D&R | Consultant | Vulnerability Assessment & Penetration Testing (VAPT) | Bengaluru

The team

Deloitte helps organizations prevent cyberattacks and protect valuable assets. We believe in being secure, vigilant, and resilient—not only by looking at how to prevent and respond to attacks, but at how to manage cyber risk in a way that allows you to unleash new opportunities. Embed cyber risk at the start of strategy development for more effective management of information and technology risks. Learn more about Cybersecurity

Your work profile

We are seeking a highly motivated and skilled Application & API VAPT (Vulnerability Assessment and Penetration Testing) Analyst with 3 to 5 years of experience in identifying, assessing, and validating security vulnerabilities across web applications, mobile applications, APIs, and cloud-hosted applications. The candidate will be responsible for conducting security assessments, supporting remediation efforts, and helping enhance the organization's security posture.

• Perform Vulnerability Assessments and Penetration Testing (VAPT) on web applications, mobile applications, APIs, and microservices.
• Conduct security testing aligned with OWASP Top 10, OWASP API Security Top 10, SANS Top 25, and CWE standards.
• Experience of Web Application Security Testing, Infrastructure VAPT, API testing.
• Understanding of AI/LLM concepts, Generative AI applications, and common AI application architectures.

Key Skills Required:

• Total 2-4 years of experience in Cyber security domain
• Understanding of basic business and information technology management processes.
• Good knowledge of TCP/ IP and Networks including Firewall, IDS/IPS, Routers, Switches, and network architecture.
• Experience of Web Application Security Testing, Infrastructure VAPT, API testing.
• Basic understanding of AI/LLM concepts, Generative AI applications, and common AI application architectures.
• Knowledge of AI security testing methodologies, including Prompt Injection, Jailbreak Testing, sensitive data exposure, and system prompt leakage.
• Ability to assist in AI penetration testing of LLM-based applications, chatbots, and RAG-based solutions under defined testing methodologies.
• Familiarity with AI security testing tools, OWASP Top 10 for LLM Applications, and basic AI guardrail validation techniques. Relevant AI Security or AI Penetration Testing certifications would be an added advantage.
• Experience on Mobile Security Pen-Testing (iOS and Android).
• Experience in conducting Configuration reviews of Servers, Network devices, Windows, Linux, UNIX, Solaris, Databases, etc.
• Experience with Vulnerability Management and Penetration testing tools: Burp suite, Kali Linux, Acunetix, AppScan, Nexpose, Qualys Guard, Nessus, Nmap, Metasploit, Fortify etc.
• Experience in basic scripting such as: Shell, Python, PERL, etc.
• Basic knowledge of Technoilogies such as: IPSEC, SSL, SSH, VPN, Ethernet Token Ring, WAP, SMTP, FTP, Frame Relay, WAN, ATM, FDDI, DSL, ISDN, HP Openview, Sun NetManage, Cisco Works, Radius, Big Brother, F5.
• Bachelor's or Master's degree in Computer Science, Information Security, Cybersecurity, or related field.
• Professional is required to work from office .
• Preferred Certifications : OSCP (Offensive Security Certified Professional)
• OSWE (Offensive Security Web Expert)
• GWAPT (GIAC Web Application Penetration Tester)
• eWPT / eWPTX / PNPT / CEH /CREST Certifications/ CISSP (Preferred for leadership positions)