T&T | Cyber: D&R | Consultant | VAPT | Bengaluru

• *Position:** Application \& API VAPT Analyst

• *Experience:** 3\-5 Years

• *Skillset** : Offensive Security

#### **Role Overview**

We are seeking a highly motivated and skilled **Application \& API VAPT (Vulnerability Assessment and Penetration Testing) Analyst** with 3 to 5 years of experience in identifying, assessing, and validating security vulnerabilities across web applications, mobile applications, APIs, and cloud\-hosted applications. The candidate will be responsible for conducting security assessments, supporting remediation efforts, and helping enhance the organization's security posture.

### **Key Responsibilities**

• Perform **Vulnerability Assessments and Penetration Testing (VAPT)** on web applications, mobile applications, APIs, and microservices.
• Conduct security testing aligned with **OWASP Top 10, OWASP API Security Top 10, SANS Top 25, and CWE standards**.
• Identify, exploit, and validate security vulnerabilities such as:
• Authentication and Authorization flaws
• SQL Injection
• Cross\-Site Scripting (XSS)
• Server\-Side Request Forgery (SSRF)
• Insecure Direct Object References (IDOR)
• Cross\-Site Request Forgery (CSRF)
• Remote Code Execution (RCE)
• Business Logic Vulnerabilities
• API\-specific vulnerabilities
• Perform manual security testing in addition to automated scanning.
• Review source code findings and validate security weaknesses where applicable.
• Assess REST, SOAP, GraphQL, and microservice\-based APIs.
• Prepare detailed VAPT reports with risk ratings, proof of concepts, and remediation recommendations.
• Conduct remediation validation and re\-testing of identified vulnerabilities.
• Collaborate with development, DevOps, and architecture teams to drive security improvements.
• Support secure SDLC activities and DevSecOps initiatives.
• Participate in threat modeling and security design reviews.
• Provide security guidance and awareness to application development teams.

### **Required Skills \& Experience**

#### **Technical Skills**

• 3\-5 years of hands\-on experience in Application Security and VAPT.
• Strong understanding of:
• OWASP Top 10
• OWASP API Security Top 10
• HTTP/HTTPS protocols
• Authentication mechanisms (OAuth 2\.0, JWT, SAML, OpenID Connect)
• Session Management and Access Controls
• Hands\-on experience with tools such as:
• Burp Suite Professional
• OWASP ZAP
• Postman
• Nmap
• Nessus
• Acunetix
• Nikto
• SQLMap
• Metasploit
• Experience testing APIs, Single Page Applications (SPA), and cloud\-native applications.
• Familiarity with CI/CD and DevSecOps practices.
• Basic understanding of AWS, Azure, or GCP security concepts.
• Ability to analyze application architecture and identify attack vectors.

### **Preferred Qualifications**

• CEH (Certified Ethical Hacker)
• eWPT (eLearnSecurity Web Application Penetration Tester)
• GWAPT (GIAC Web Application Penetration Tester)
• OSCP (Offensive Security Certified Professional)
• PNPT or equivalent offensive security certifications
• Knowledge of secure coding practices and code review methodologies

### **Educational Qualifications**

• Bachelor's degree in Computer Science, Information Security, Cybersecurity, or related field.
• Relevant cybersecurity certifications preferred.

### **Key Competencies**

• Strong analytical and problem\-solving skills
• Excellent report\-writing and communication skills
• Ability to work independently and manage multiple assessments
• Stakeholder management and presentation skills
• Attention to detail and risk\-based thinking

### **Nice to Have**

• Experience with SAST, DAST, SCA, and Container Security tools.
• Exposure to Kubernetes, Docker, and Cloud Security assessments.
• Experience supporting large enterprise vulnerability management programs.