Job highlights

- Job Summary. We are looking for a highly skilled Senior Security Analyst with 6-7 years of hands-on experience in Vulnerability Assessment and Penetration Testing (VAPT) across web applications,APIs,mobile applications (Android / iOS),internal and external infrastructure,and AI-powered applications.
- Required Technical Skills

Job Summary

We are looking for a highly skilled Senior Security Analyst with 6-7 years of hands-on experience in Vulnerability Assessment and Penetration Testing (VAPT) across web applications, APIs, mobile applications (Android/iOS), internal and external infrastructure, and AI-powered applications. The candidate must have robust expertise in manual penetration testing, vulnerability validation, exploitation, security reporting, and remediation guidance. Client handling, technical reporting, and the ability to independently manage end-to-end security assessments are mandatory requirements.

The ideal candidate should be capable of leading technical assessments, communicating findings to clients and stakeholders, mentoring junior team members, and conducting security testing of AI/LLM-based applications and integrations.

Key Responsibilities

- Web Application and API Penetration Testing: Conduct manual and automated penetration testing of web applications, REST/SOAP APIs, and GraphQL endpoints; identify and validate vulnerabilities related to authentication, authorization, access control, injection, SSRF, XSS, CSRF, IDOR/BOLA, business logic, file uploads, and privilege escalation; assess JWT, OAuth 2.0, session management, API keys, rate limiting, and sensitive data exposure; perform in-depth testing aligned with OWASP Top 10, OWASP API Security Top 10, and OWASP Web Security Testing Guide; identify complex attack chains and business logic vulnerabilities that automated scanners may miss.
- Mobile Application Penetration Testing: Perform static and dynamic security testing of Android APK and iOS IPA applications; analyze application binaries, configurations, permissions, local storage, cryptographic implementations, and network communications; identify insecure data storage, hardcoded secrets, certificate validation weaknesses, insecure deep links, WebView issues, and runtime vulnerabilities; use tools such as MobSF, JADX, apktool, ADB, Frida, objection, and Burp Suite; validate mobile application vulnerabilities and assess associated backend API security.
- Internal and External Infrastructure Penetration Testing:



Conduct infrastructure VAPT across servers, endpoints, network devices, VPNs, and externally exposed services; perform network discovery, service enumeration, vulnerability validation, exploitation, and privilege escalation testing; assess Windows, Linux, Active Directory, domain controllers, and common enterprise services; identify misconfigurations, weak authentication, excessive privileges, insecure protocols, outdated software, and network segmentation weaknesses; perform authorized Active Directory security assessments, including privilege escalation paths, Kerberoasting exposure, and insecure delegation; use tools such as Nmap, Nessus, Qualys, BloodHound, Impacket, and NetExec.
- AI and LLM Application Penetration Testing: Conduct security assessments of AI-powered applications, LLM integrations, chatbots, AI agents, and retrieval-augmented generation (RAG) systems; test for direct and indirect prompt injection, system prompt disclosure, insecure tool invocation, excessive agency, and unauthorized actions; assess sensitive information disclosure, insecure output handling, improper access controls, and cross-user data leakage; test RAG pipelines for document-level authorization weaknesses, data leakage, and malicious content injection; assess AI application integrations, plugins, external tools, APIs, and agent permissions for security weaknesses; evaluate risks associated with insecure output handling, denial-of-service, resource consumption, and model abuse; apply relevant guidance from the OWASP Top 10 for LLM Applications and other applicable AI security testing frameworks; document attack scenarios, business impact, reproducible proof of concept, and practical mitigation measures.
- Client Handling and Stakeholder Management: Independently handle client communications throughout the assessment lifecycle; conduct technical kickoff meetings, scope discussions, requirement gathering, and rules-of-engagement reviews; explain technical findings, business impact, severity ratings,



and remediation priorities to technical and non-technical stakeholders; participate in client review meetings, vulnerability walkthroughs, remediation discussions, and closure meetings; respond to client queries, clarify findings, provide supporting evidence, and defend technical conclusions with appropriate proof of concept; coordinate with development, infrastructure, and security teams to support remediation and retesting; manage client expectations, assessment timelines, dependencies, and deliverables professionally.
- Technical Reporting and Documentation: Prepare high-quality VAPT reports covering executive summaries, scope, methodology, findings, evidence, severity ratings, impact, and remediation recommendations; write clear and reproducible technical findings supported by screenshots, request/response evidence, commands, and proof of concept where appropriate; assign severity using CVSS and business context, ensuring risk ratings are justified; provide practical remediation recommendations tailored to the affected technology and vulnerability; prepare consolidated reports for web applications, APIs, mobile applications, infrastructure, and AI security assessments; review reports for technical accuracy, consistency, completeness, duplication, and false positives before client delivery; prepare retest reports and validate remediation effectiveness.
- Assessment Ownership and Technical Leadership: Independently plan and execute end-to-end penetration testing engagements; define testing approaches, prioritize high-risk areas, and adapt methodologies to different environments; review vulnerability findings and technical reports prepared by junior analysts; mentor junior team members on manual testing, exploitation techniques, evidence collection, and reporting standards; support effort estimation, project planning, assessment tracking, and delivery quality; keep up to date with emerging vulnerabilities, exploitation techniques, AI security risks, and penetration testing methodologies.

Required Technical Skills

- Strong hands-on experience in manual web application, API, mobile, and infrastructure penetration testing.
- Practical understanding of OWASP Top 10, OWASP API Security Top 10.

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.

📌 Senior Security Analyst (Chennai)
🏢 SecqureOne
📍 Chennai