Must have

- 6+ years application penetration testing or security test engineering, with specific experience testing

authentication and session-management controls.
- OSCP, GWAPT, CREST or equivalent, or a demonstrable track record in lieu.
- Test leadership on regulated customer-facing systems, including ownership of traceability and evidence

artefacts.
- Comfortable authoring abuse cases, not only functional scripts.
- Client-facing during UAT and security workshops.
- 4+ years hands-on functional, regression, performance and accessibility execution.
- Test automation capability sufficient to automate a multi-state journey within a single cycle.
- Performance testing tooling and the ability to calibrate to a supplied volume profile.

Security testing Burp Suite Skilled — Repeater, Intruder, Sequencer, Comparer, macros and session handling rules





OWASP ZAP ffuf or wfuzz for enumeration and fuzzing

Manual request crafting and interception

Concurrency and race-condition testing on issuance and verification

Timing measurement across many samples to prove response uniformity on identity match and non-match

Log and telemetry inspection to evidence absence of passcode material

Test automation

Playwright or Selenium WebDriver, in C#, Java or TypeScript bindings

REST Assured or RestSharp for API-level cases xUnit, NUnit, JUnit 5 or TestNG

Page object or equivalent structuring for a multi-state journey

Performance

JMeter, k6 or Gatling

Correlation, parameterisation and think-time modelling

Result analysis against a supplied peak profile

📌 Lead Software Engineer (Hyderabad)
🏢 Virtusa
📍 Hyderabad