Location: Kolkata, Onsite

Experience: 1–3 years

About the Role: We are looking for a Cybersecurity Associate to help secure Hiyaku Systems [recent entity of Kofuku Technologies], an anonymous social platform focused on health information and community interaction. You'll work hands-on across our web application, REST APIs, GraphQL APIs, authentication, authorization, and business logic, identifying vulnerabilities and helping the engineering team fix and prevent them.

Key Responsibilities:
Perform manual and automated Web & API VAPT.
Identify vulnerabilities across OWASP Top 10 and API Security.
Test IDOR/BOLA, authentication, authorization, privilege escalation and business logic.
Assess anonymous-user privacy and sensitive health-information exposure.
Test REST and GraphQL APIs for access-control and data-exposure issues.
Assess file uploads, session management, JWT/token security and rate limiting.
Use tools such as Burp Suite, OWASP ZAP, Nmap, Nuclei and Postman.
Manually validate vulnerabilities and minimize false positives.
Prepare transparent VAPT reports with evidence, impact and remediation recommendations.
Perform security retesting after vulnerabilities are fixed.

What We're Looking For:




1–3 years of experience in Cybersecurity Associate.
Good understanding of OWASP Top 10 and API security.
Practical knowledge of Burp Suite and web/API testing.
Understanding of HTTP, REST, GraphQL, authentication and authorization.
Knowledge of IDOR/BOLA and business-logic vulnerabilities.
Basic scripting/programming knowledge in Python and SQL.
Solid analytical and problem-solving skills.
Good technical documentation and communication skills.
Educational Qualification should be Btech or BE.
Certifications such as eJPT, PNPT, CEH or OSCP are a plus, but practical skills matter more.

If you're passionate about cybersecurity, enjoy finding vulnerabilities, and want to work closely with developers to build a more secure product, we'd love to hear from you.

Application Question(s)
What tools have you used for Cybersecurity test?
We're operational from Kolkata, WB. Are you comfortable working onsite?

Education:
Bachelor's (Required)

Experience:
Cybersecurity: 1 year (Required)
API Security Testing: 1 year (Required)
Penetration testing: 1 year (Required)

Language:
English (Required)

Work Location: In person

📌 Cybersecurity Associate Kolkata
🏢 Kofuku Technologies
📍 Kolkata