Vapt Engineer

Role & responsibilities

Job Summary

We are looking for a skilled IT Security Engineer with 36 years of experience in Vulnerability Assessment and Penetration Testing (VAPT), application security, and vulnerability management. The ideal candidate will have hands-on experience in identifying, analyzing, validating, and reporting security vulnerabilities across web applications, APIs, and software components.

The candidate should have strong expertise in VAPT, penetration testing, DAST, SAST, SCA, Burp Suite, and Cross-Site Scripting (XSS), along with a solid understanding of web application security, OWASP Top 10, and secure coding practices.

Key Responsibilities

• Perform Vulnerability Assessment and Penetration Testing (VAPT) on web applications, APIs, and other application environments.
• Conduct manual and automated penetration testing to identify security weaknesses and exploitable vulnerabilities.
• Perform DAST (Dynamic Application Security Testing) to identify runtime vulnerabilities in applications.
• Perform SAST (Static Application Security Testing) to detect security flaws in source code.
• Conduct SCA (Software Composition Analysis) to identify vulnerable open-source libraries, third-party dependencies, and software components.
• Use Burp Suite extensively for web application security testing, request manipulation, vulnerability validation, and penetration testing.
• Identify, exploit safely, and validate vulnerabilities such as Cross-Site Scripting (XSS), SQL Injection, CSRF, IDOR/Broken Access Control, SSRF, authentication flaws, and security misconfigurations.
• Assess applications against the OWASP Top 10 and relevant application security standards.
• Analyze vulnerability scan results, eliminate false positives, assess risk, and prioritize findings based on severity and business impact.
• Prepare detailed security assessment reports with proof of concept, risk ratings, remediation recommendations, and mitigation strategies.
• Collaborate with developers, DevOps, QA, and infrastructure teams to resolve identified vulnerabilities.
• Conduct retesting and remediation validation to ensure reported vulnerabilities have been effectively addressed.
• Support secure SDLC practices and integrate security testing tools into CI/CD pipelines.
• Stay updated on emerging vulnerabilities, attack techniques, security advisories, and industry best practices