Vapt Auditor

TaxoSmart is looking for a hands-on Ethical Hacker / VAPT Engineer to perform Vulnerability Assessment and Penetration Testing of our web applications, APIs, servers, mobile application and infrastructure, primarily supporting enterprise and BFSI applications.

Key Responsibilities

• Perform Web Application, API and Network VAPT.
• Identify, validate and document security vulnerabilities.
• Conduct manual testing based on OWASP Top 10 and OWASP API Security Top 10.
• Test authentication, authorization, session management, access control, injection, XSS, CSRF, SSRF, file upload, business logic and security misconfiguration.
• Perform vulnerability assessment of Linux/Windows servers, NGINX, Tomcat, databases and network services.
• Prepare professional VAPT reports, PoCs, evidence and remediation recommendations.
• Perform vulnerability retesting and closure validation.
• Work with Development, QA, DevOps and Infrastructure teams for remediation.
• Support BFSI customer security assessments, audits and compliance requirements.

Required Skills

• CEH certification Mandatory
• 0–5 years practical VAPT / Ethical Hacking experience.
• Strong knowledge of OWASP Top 10.
• Hands-on experience with Burp Suite, Kali Linux, Nmap, Nessus/OpenVAS, Metasploit, OWASP ZAP, SQLMap and Postman.
• Strong understanding of HTTP/HTTPS, TCP/IP, DNS and networking.
• Experience in Web Application and REST API security testing.
• Good understanding of authentication, authorization and access-control vulnerabilities.
• Basic scripting knowledge in Python / Bash / JavaScript / SQL.
• Good technical documentation and communication skills.

Preferred

• CEH Practical / OSCP / eJPT / PNPT.
• Experience with BFSI/Banking applications.
• Knowledge of Java/Spring Boot, React, REST APIs, NGINX, Tomcat and Oracle.
• Experience with SAST/DAST, Secure SDLC and ISO 27001.