VAPT Engineer

VAPT Engineer (Vulnerability Assessment & Penetration Testing)

About the Role

We are looking for a highly motivated and skilled VAPT Engineer to join our growing cybersecurity team. In this role, you will be responsible for identifying and assessing security vulnerabilities across web applications, mobile applications, APIs, networks, cloud environments, and infrastructure through comprehensive vulnerability assessments and penetration testing.

If you are passionate about ethical hacking, offensive security, and helping organizations strengthen their cybersecurity posture, we'd love to hear from you.

Key Responsibilities

• Perform Vulnerability Assessment and Penetration Testing (VAPT) on web applications, mobile applications, APIs, internal and external networks, and cloud environments.
• Conduct both manual and automated security testing.
• Identify vulnerabilities, exploit weaknesses, and provide actionable remediation recommendations.
• Prepare detailed technical reports and executive summaries.
• Collaborate with development and infrastructure teams to validate and verify security fixes.
• Perform security re-testing after remediation activities.
• Stay updated with the latest cybersecurity threats, attack techniques, and security tools.
• Support security audits, compliance assessments, and security-related initiatives as required.

Qualifications

Required Skills & Experience

• At least 3 years of experience in vulnerability scanning, analysis, and penetration testing of websites, cloud-hosted applications, APIs, and networks.

• Strong understanding of:

  • OWASP Top 10
  • Network security
  • Web application security
  • API security
  • Authentication and authorization mechanisms
  • Mobile security frameworks

• Hands-on experience with security tools such as:

  • Burp Suite
  • Nmap
  • Metasploit
  • Nessus
  • Wireshark
  • OpenVAS

• Knowledge of Linux and Windows environments.

• Experience with scripting using Python, Bash, or PowerShell.

• Understanding of secure coding principles.

• Experience in manual penetration testing and exploit validation.

• Strong technical documentation and reporting skills.

• Knowledge of DevSecOps and integrating security into CI/CD pipelines.

• Experience with application session management.

• Good knowledge of modifying and compiling exploit code.

• Exposure to ethical hacking programs such as Bug Bounty, Capture the Flag (CTF), or other security competitions.

Preferred Qualifications

• One or more industry certifications, including:

  • OSCP
  • CEH
  • eJPT
  • GWAPT
  • CISSP
  • SANS
  • GXPN

• Experience with:

  • Mobile application security testing
  • Cloud security
  • Red Team activities
  • Source code review
  • DevSecOps practices

Nice to Have

• Experience in fintech, banking, or digital wallet applications.
• Knowledge of secure SDLC and compliance frameworks.
• Experience working in high-availability production environments with aggressive SLA requirements.