VAPT Analyst — Manual Security Testing

VAPT Analyst — Manual Security Testing

Location: Gurugram (Sector 61, Golf Course Extension Road) / Client sites, with frequent travel

Gurugram-headquartered technology firm delivering cybersecurity, application development, and AI-powered solutions to enterprise, government, and law-enforcement clients in India and overseas. Its cybersecurity practice spans VAPT, SOC and monitoring, network/infrastructure security, and offensive security, alongside a product portfolio that includes encrypted communication platforms, geospatial intelligence tools, secure VPN, and investigative platforms.

About the Role

We're looking for an experienced VAPT Analyst who thinks like an attacker and can manually uncover vulnerabilities that automated scanners miss. You'll run hands-on security assessments — including on mission-critical, high-sensitivity systems — across web, API, mobile, network, and enterprise environments, and support red teaming engagements as a regular part of the work.

What You Will Do

1. Conduct Vulnerability Assessment and Penetration Testing across web applications, APIs, mobile applications, networks, and infrastructure.
2. Perform detailed manual security testing to uncover complex vulnerabilities and attack paths beyond what automated tools surface.
3. Validate and exploit identified vulnerabilities to assess real-world risk.
4. Conduct both authenticated and unauthenticated assessments, including network reconnaissance, enumeration, exploitation, and privilege escalation.
5. Prepare detailed technical reports with risk ratings and remediation guidance for technical and business audiences.
6. Support red teaming and adversary simulation exercises as a regular part of the role.
7. Coordinate with development, infrastructure, and security teams through to remediation closure.
8. Travel frequently to client sites, including government/law-enforcement locations, as project needs require.

What We're Looking For

1. 7 years of hands-on experience in VAPT, Penetration Testing, or Offensive Security.
2. An active, valid certification — OSCP, CEH, eWPT, CRTP, PNPT, or equivalent — is mandatory.
3. Strong hands-on manual testing expertise across web applications and APIs, not just tool-driven scanning.
4. Solid grasp of OWASP Top 10, SANS Top 25, authentication flaws, business logic vulnerabilities, and infrastructure exploitation.
5. Practical experience with Burp Suite, Nmap, Metasploit, Nessus, Wireshark, SQLMap, and similar tools.
6. Strong networking, OS, and web technology fundamentals paired with real attack methodology experience.
7. Experience with infrastructure, wireless, or Active Directory security assessments preferred.
8. Strong analytical, documentation, and reporting skills.
9. Must be willing and eligible to clear a background check / police verification / security clearance process given the sensitivity of client engagements.