Experience: 4-6 years
Location: Client Site (Mumbai)
Reporting to: Engagement Lead, NMT Security

About the role

This role leads manual security testing of web application portfolio, including visa processing portals, e-visa systems, biometric/facial verification services, and appointment booking platforms handling sensitive applicant PII.

Key responsibilities

Lead manual VAPT across web applications, APIs, and business logic flows, with emphasis on IDOR, authentication bypass, privilege escalation, and workflow abuse over automated scanning
Design and execute test cases for appointment/slot booking systems, rescheduling flows, and facial verification/biometric services, targeting logic flaws over generic vulnerability classes
Own end-to-end authenticated testing across multi-tenant, multi-country deployments of the same codebase
Write clear, client-ready vulnerability reports with CVSS scoring, business impact analysis, and remediation guidance
Mentor and review work of junior team member, validate findings before client reporting,



Interface directly with the security/engineering stakeholders on findings, retest cycles, and closure Maintain strict data handling discipline given the PII sensitivity of the target environment (visa applicant data, biometric data)

Required skills
4-6 years in web application penetration testing / VAPT, with a portfolio of manual, non-scanner-driven findings
Robust hands-on experience with IDOR discovery, business logic testing, and privilege escalation, not just OWASP Top 10 checklist testing
Proficiency with Burp Suite, Postman/API testing tools, and manual request manipulation
Experience testing authentication flows, session management, and multi-step business workflows (bookings, registrations, approvals)
Comfortable working across multiple similar-but-distinct app instances (same codebase, different country deployments)
Strong report writing and client communication skills
CVEs, bug bounty track record, or OSCP/CRTP/similar cer

📌 Senior Penetration Tester (Mumbai)
🏢 NMT Security
📍 Mumbai