## Job highlights
- Job Summary. We are looking for an experienced Security Analyst with 4-5 years of hands-on experience in Vulnerability Assessment and Penetration Testing (VAPT) across web applications,APIs,Android applications (APK),iOS applications (IPA),and IT infrastructure. ### Job Summary We are looking for an experienced Security Analyst with 4-5 years of hands-on experience in Vulnerability Assessment and Penetration Testing (VAPT) across web applications, APIs, Android applications (APK), iOS applications (IPA), and IT infrastructure. The candidate should have solid expertise in identifying, validating, exploiting, and documenting security vulnerabilities across different technology stacks. The ideal candidate must be capable of independently executing penetration tests, assessing business impact, recommending effective remediation measures, and preparing comprehensive technical and executive-level reports. The candidate should have a strong understanding of OWASP security standards, manual testing methodologies, penetration testing tools, and security assessment frameworks. ###

Key Responsibilities
#### Web Application Penetration Testing
- Perform manual and automated penetration testing of web applications to identify security vulnerabilities.
- Assess applications against the OWASP Top 10 and OWASP Web Security Testing Guide.
- Identify and validate vulnerabilities such as SQL Injection, Cross-Site Scripting (XSS), Server-Side Request Forgery (SSRF), Broken Access Control, IDOR/BOLA, authentication and authorization flaws, CSRF, file upload vulnerabilities, path traversal, command injection, and business logic vulnerabilities.
- Test session management, password policies, account lockout, MFA implementation, password reset functionality, and authentication mechanisms.
- Assess security headers, cookie attributes, CORS policies, TLS configuration, and sensitive information exposure.
- Perform role-based access control testing, privilege escalation testing, and horizontal and vertical access control assessments.
- Identify vulnerabilities in application workflows, business logic, and multi-step transactions.
- Manually validate scanner findings to eliminate false positives and identify vulnerabilities that automated tools may miss. #### API Security Testing
- Conduct penetration testing of REST, SOAP, GraphQL, and other API implementations.
- Test APIs for authentication and authorization weaknesses, Broken Object Level Authorization (BOLA), Broken Function Level Authorization (BFLA), and excessive data exposure.
- Assess API endpoints for injection attacks,



mass assignment, improper input validation, rate-limiting weaknesses, and business logic vulnerabilities.
- Test JWT implementation, OAuth 2.0, OpenID Connect, API keys, access tokens, refresh tokens, and session handling.
- Evaluate API security controls, including CORS, HTTP methods, request validation, error handling, and sensitive data transmission.
- Test for unrestricted resource consumption, replay attacks, and abuse of business-critical API functionality.
- Review API specifications, including Swagger/OpenAPI documentation, to identify undocumented or improperly secured endpoints.
- Prepare detailed findings with reproducible proof of concept, impact analysis, and remediation recommendations. #### Android Application Security Testing (APK)
- Perform static and dynamic security assessments of Android applications.
- Analyze APK files using tools such as MobSF, JADX, apktool, and Android Debug Bridge (ADB).
- Identify hardcoded credentials, API keys, secrets, insecure local storage, improper cryptographic implementations, and sensitive information leakage.
- Test insecure inter-process communication, exported activities and services, content providers, broadcast receivers, and deep links.
- Assess certificate validation, TLS implementation, WebView security, root detection, and application tampering protections.
- Test authentication, authorization, session management, and business logic within mobile applications.
- Analyze application network traffic using Burp Suite or equivalent proxy tools.
- Assess local databases, shared preferences, files, logs, backups, and cached application data for sensitive information exposure.
- Identify risks associated with insecure permissions, intent handling, and improper platform security configurations. #### iOS Application Security Testing (IPA)
- Conduct static and dynamic security assessments of iOS applications.
- Analyze IPA packages, application binaries, entitlements, property list files, and application configurations.
- Use tools such as MobSF, Frida, objection, Burp Suite, and suitable iOS analysis utilities.
- Assess insecure storage of sensitive information in Keychain, local files, databases, logs,



and application caches.
- Test ATS configuration, TLS certificate validation, URL schemes, Universal Links, and WebView security.
- Identify hardcoded secrets, insecure cryptographic implementations, improper authentication, and authorization weaknesses.
- Assess jailbreak detection, runtime manipulation resistance, and application tampering protections where applicable.
- Perform runtime instrumentation and dynamic analysis on authorized test devices or emulators.
- Test mobile application API communications and validate server-side authorization controls. #### Internal and External Infrastructure Penetration Testing
- Conduct internal and external infrastructure vulnerability assessments and penetration tests across servers, endpoints, network devices, VPNs, and exposed services.
- Perform network discovery, port scanning, service enumeration, operating system identification, and vulnerability validation.
- Assess Windows and Linux systems, Active Directory environments, domain controllers, and common enterprise services.
- Identify and validate vulnerabilities arising from outdated software, insecure configurations, weak authentication, excessive privileges, and exposed services.
- Perform Active Directory security assessments covering Kerberoasting exposure, weak service account configurations, excessive privileges, insecure delegation, and common privilege escalation paths.
- Assess SMB, SSH, RDP, LDAP, DNS, FTP, VPN, and other network services for security weaknesses.
- Validate patch management, insecure protocols, password policies, access controls, and system hardening configurations.
- Assess firewall rules, network segmentation, externally exposed services, and opportunities for unauthorized access.
- Perform controlled exploitation and privilege escalation testing within the agreed scope and rules of engagement.
- Use vulnerability scanners such as Nessus, Qualys, or equivalent tools, followed by manual verification and risk prioritization.
- Document attack paths and explain the business impact of identified weaknesses. #### Reporting and Remediation Validation
- Prepare comprehensive VAPT reports with executive summaries, technical findings, severity ratings, proof of concept, affected assets, impact, and remediation recommendations. Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.

📌 Security Analyst (Chennai)
🏢 SecqureOne
📍 Chennai