Experience: 4-6 years

Location: Client Site (Mumbai)

Reporting to: Engagement Lead, NMT Security

About the role

This role leads manual security testing of web application portfolio, including visa processing portals, e-visa systems, biometric/facial verification services, and appointment booking platforms handling sensitive applicant PII.

Key responsibilities

1. Lead manual VAPT across web applications, APIs, and business logic flows, with emphasis on IDOR, authentication bypass, privilege escalation, and workflow abuse over automated scanning
2. Design and execute test cases for appointment/slot booking systems, rescheduling flows, and facial verification/biometric services, targeting logic flaws over generic vulnerability classes
3. Own end-to-end authenticated testing across multi-tenant, multi-country deployments of the same codebase
4. Write clear, client-ready vulnerability reports with CVSS scoring, business impact analysis, and remediation guidance
5. Mentor and review work of junior team member, validate findings before client reporting, Interface directly with the security/engineering stakeholders on findings, retest cycles,



and closure Maintain strict data handling discipline given the PII sensitivity of the target environment (visa applicant data, biometric data)

Required skills

1. 4-6 years in web application penetration testing / VAPT, with a portfolio of manual, non-scanner-driven findings
2. Strong hands-on experience with IDOR discovery, business logic testing, and privilege escalation, not just OWASP Top 10 checklist testing
3. Proficiency with Burp Suite, Postman/API testing tools, and manual request manipulation
4. Experience testing authentication flows, session management, and multi-step business workflows (bookings, registrations, approvals)
5. Comfortable working across multiple similar-but-distinct app instances (same codebase, different country deployments)
6. Strong report writing and client communication skills
7. CVEs, bug bounty track record, or OSCP/CRTP/similar certification is a strong plus

Positive to have

Prior experience testing appointment/booking or govt-facing citizen service platforms

Familiarity with facial recognition/biometric verification testing

Experience in regulated/PII-heavy environments (BFSI, govt, healthcare)

📌 Senior Penetration Tester / VAPT Consultant (Mumbai)
🏢 NMT Security
📍 Mumbai