Vulnerability Assessment and Penetration Testing (VAPT)

- Conduct manual and automated security assessments of web applications, REST APIs, mobile applications, and network infrastructure.

- Perform penetration testing to identify vulnerabilities, misconfigurations, and potential attack vectors.

- Validate findings, assess business impact, and recommend appropriate remediation measures.

- Perform retesting to verify that identified vulnerabilities have been successfully resolved.

- Prepare detailed VAPT reports with proof of concept, risk ratings, technical evidence, and remediation guidance.

- Conduct security assessments aligned with OWASP Top 10, OWASP API Security Top 10, and relevant industry standards.

Application Security (AppSec)

- Integrate security practices into the Software Development Life Cycle (SSDLC).

- Perform secure code reviews to identify common coding vulnerabilities and security weaknesses.

- Conduct SAST, DAST, Software Composition Analysis (SCA), and secrets scanning.

- Identify and assess vulnerabilities such as SQL injection, cross-site scripting (XSS), broken access control, authentication flaws, SSRF, insecure deserialization, and business logic vulnerabilities.

- Support threat modeling and security architecture reviews for new features and applications.

- Provide secure coding recommendations to developers and help validate remediation.

API and Mobile Application Security

- Assess API authentication, authorization, input validation, rate limiting, and data exposure risks.

- Perform security testing of Android and iOS applications, including static and dynamic analysis.

- Evaluate session management, cryptographic implementations, sensitive data storage, and communication security.





- Identify insecure integrations and third-party component risks.

Vulnerability Management and Reporting

- Maintain a vulnerability register and track findings through remediation and closure.

- Prioritize vulnerabilities based on severity, exploitability, business impact, and exposure.

- Work with development and infrastructure teams to establish remediation timelines.

- Track remediation SLAs and report vulnerability trends and security metrics.

- Support compliance and audit requirements related to application security and penetration testing.

Security Automation and Collaboration

- Integrate security testing tools into CI/CD pipelines and DevSecOps workflows.

- Help reduce false positives and improve the effectiveness of security testing.

- Collaborate with developers, QA, DevOps, and architecture teams to resolve security issues.

- Conduct security awareness sessions and provide guidance on secure development practices.

- Stay updated on emerging vulnerabilities, attack techniques, CVEs, and security testing methodologies.

Required Technical Skills

- Strong understanding of web application, API, and network security.

- Hands-on experience with penetration testing and vulnerability assessment methodologies.

- Knowledge of OWASP Top 10, OWASP API Security Top 10, and common application security vulnerabilities.

- Experience with tools such as Burp Suite Skilled, OWASP ZAP, Nmap, Nessus, and Postman.





- Familiarity with SAST, DAST, and SCA tools such as SonarQube, Checkmarx, Fortify, Veracode, or Snyk.

- Understanding of HTTP/HTTPS, TCP/IP, DNS, TLS, authentication, authorization, OAuth 2.0, and JWT.

- Experience with Linux, Windows, web technologies, databases, and cloud application security fundamentals.

- Ability to document security findings and communicate technical risks clearly.

- Basic scripting or programming skills in Python, JavaScript, Bash, or similar languages.

Preferred Qualifications

- Experience with mobile application security testing using tools such as MobSF, Frida, or JADX.

- Knowledge of cloud security across AWS, Azure, or GCP.

- Familiarity with container security, Docker, Kubernetes, and CI/CD pipeline security.

- Experience with threat modeling methodologies such as STRIDE.

- Knowledge of secure coding practices and common vulnerabilities in Java, Python, JavaScript, or .NET applications.

- Certifications such as OSCP, OSWE, eWPTX, CEH, Security+, or equivalent practical experience.

Educational Qualifications

- Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related discipline.

- Relevant hands-on cybersecurity experience may be considered in place of specific certifications.

Key Competencies

- Strong analytical and problem-solving skills.

- Attention to detail and a methodical approach to security testing.

- Ability to distinguish exploitable vulnerabilities from false positives.

- Clear technical report writing and stakeholder communication.

- Ability to work independently and collaboratively in a fast-paced environment.

- Commitment to ethical testing and responsible vulnerability disclosure

📌 Immediate Hiring For VAPT (Face To face interview) (Pune)
🏢 Contactx Resource Management
📍 Pune