About Company:

BDO is a global network of professional services firms with a presence in over 166 countries, revenue of over USD 14 billion, and experience of over 60 years. Its a leading service provider for the mid-markets with client service at its heart.

BDO India Services Private Limited (or BDO India) is the India member firm of BDO International. BDO India offers strategic, operational, accounting and tax, and regulatory advisory & assistance for both domestic and international organizations across a range of industries. BDO India is led by more than 300+ Partners & Directors with a team of over 10,000 professionals operating across 14 cities and 20 offices.

We expect to grow sizably in the coming 3-5 years, adding various dimensions to our business and multiplying and increasing the current team size multi-fold

Role Overview

We are looking out for candidate having good experience in VAPT to support and execute vulnerability assessment and penetration testing engagements across web applications, networks, systems, and emerging AI-based applications. The role requires foundational technical skills, hands-on testing capabilities, and an eagerness to leverage AI tools to enhance security testing efficiency.

Candidate requirements:

- B.E./B.Tech/MCA/M.Sc. in Computer Science, Information Technology, Cybersecurity, or a related field.
- 3-6 years of experience in both Vulnerability Assessment and Penetration Testing
- Strong working knowledge of tools such as Burp Suite (Pro), Nessus, Nmap, Metasploit, OWASP ZAP, SQLmap, Kali Linux toolset, MobSF, Postman, Frida, and Wireshark.
- Solid understanding of testing methodologies and standards such as OWASP, PTES, OSSTMM, NIST SP 800-115, and MITRE ATT&CK.;
- Proficiency in scripting or automation (Python, Bash, or PowerShell) for custom exploits and testing workflows.
- Good understanding of networking, operating systems (Windows and Linux), Active Directory, and common attack paths.
- Exposure to mobile application testing (Android/iOS), API testing,



and cloud security testing (AWS, Azure, or GCP) is an advantage.
- Active participation in Hack The Box, TryHackMe, bug bounty programs, CTFs, or hackathons is an added value.

Preferred Certifications

- Certified Ethical Hacker (CEH) – preferable
- OSCP / OSCP+ (strong advantage)
- eJPT / eCPPT / PNPT / CRTP / GPEN / GWAPT / CPTS
- Burp Suite Certified Practitioner
- Cloud security certifications (AWS Security Specialty, Azure Security Engineer Associate) – added advantage

Key Responsibilities

- Plan and execute vulnerability assessment and penetration testing (VAPT) engagements across web applications, mobile applications, APIs, networks, and infrastructure.
- Perform manual and automated web application penetration testing aligned to OWASP Top 10, OWASP ASVS, and the OWASP API Security Top 10.
- Conduct network, wireless, and thick client security testing, and support secure configuration reviews of servers, databases, and network devices.
- Identify, exploit, and validate vulnerabilities such as injection flaws, authentication and authorization bypass, business logic flaws, and misconfigurations. Assess their business impact.
- Assist in red team and adversary simulation exercises, social engineering assessments, and source code review where required.
- Support security testing of cloud-hosted environments and cloud-native workloads (containers, APIs, DevOps pipelines).
- Prepare transparent, client-ready reports covering technical findings, risk ratings (CVSS), proof of concept, and actionable remediation recommendations.
- Conduct retests and validate closure of reported vulnerabilities.
- Present findings and walk through technical details with client stakeholders and development teams.
- Mentor and guide Assistants/Sr. Assistants on testing methodologies, tooling, and report quality, and review their work.
- Collaborate with senior consultants on proposals, scoping, proof-of-concepts, and client presentations.
- Research and stay current with emerging vulnerabilities, exploits, attack techniques, and industry practices (CVEs, MITRE ATT&CK;, threat intelligence).

📌 Senior Associate - Cyber Security - VAPT (Karnataka)
🏢 BDO India
📍 Karnataka