Key ResponsibilitiesWeb Application Security Testing

- Identify vulnerabilities such as SQL Injection, Cross-Site Scripting (XSS), CSRF, SSRF, IDOR, Authentication Bypass, and Remote Code Execution.
- Validate business logic flaws and privilege escalation issues.
- Test session management, access controls, and file upload security.

Mobile Application Security Testing

- Analyze mobile app binaries and runtime behavior.
- Evaluate secure storage, certificate pinning, root/jailbreak detection, and API protections.
- Verify app attestation and anti-tampering controls.

API Security Testing

- Test REST, GraphQL, and WebSocket APIs.
- Assess authentication and authorization mechanisms including OAuth 2.0, OpenID Connect, and JWT.
- Identify Broken Object Level Authorization (BOLA), rate limiting gaps, and injection vulnerabilities.

Infrastructure & Network Security

- Conduct security assessments of Linux and macOS servers, firewalls, and internal networks.
- Review exposed ports, services, and misconfigurations.
- Test SSH, VPN, TLS, DNS, and network segmentation.

Cloud Security

- Assess environments in Amazon Web Services, Microsoft Azure, and Google Cloud.
- Review IAM permissions, storage exposure, security groups, and container security.

Container & CI/CD Security

- Assess Docker, Kubernetes, and CI/CD pipelines.
- Evaluate secrets management and software supply chain risks.

Vulnerability Management & Remediation

- Prepare detailed reports with severity ratings, proof of concept, impact analysis, and remediation guidance.
- Collaborate with developers and DevOps teams to verify and retest fixes.
- Prioritize findings based on business impact and exploitability.





Security Automation

- Integrate automated scans into Jenkins, GitHub Actions, or other CI/CD systems.
- Develop scripts to automate reconnaissance and validation.

Preferred Qualifications

- Strong understanding of contemporary authentication and authorization models.
- Experience working with development and DevSecOps teams

Certifications (preferred)

- OffSec OSCP / OSWE
- EC-Council CEH
- GIAC GPEN / GWAPT
- OWASP Foundation Web Security Tester certifications

Deliverables

- Comprehensive VAPT reports
- Proof-of-concept demonstrations
- Remediation recommendations
- Retest and closure reports
- Security hardening guidance

Required Technical SkillsSecurity Domains

- Web Application Security
- Mobile Application Security
- API Security
- Network Security
- Cloud Security
- Secure Code Review

Standards & Methodologies

- OWASP Top 10
- OWASP Mobile Top 10
- MITRE ATT&CK;
- CVSS Scoring

Tools

- Burp Suite
- OWASP ZAP
- Nmap
- Metasploit
- Wireshark
- MobSF
- Trivy
- Nessus

Programming & Scripting

- Python
- Bash
- JavaScript (for security testing)
- Linux command line proficiency

Pay: ₹1,200,000.00 - ₹1,500,000.00 per year

Benefits :

- Health insurance
- Leave encashment
- Paid sick time
- Provident Fund

Ability to commute/relocate:

- Kolkata, West Bengal: Reliably commute or planning to relocate before starting work (required)

Experience :

- Python: 4 years (required)
- Bash (Unix shell): 4 years (required)

License/Certification:

- OSWE (preferred)
- CEH (preferred)
- GWAPT (preferred)

Location :

- Kolkata, West Bengal (preferred)

Work Location: In person

📌 Ethical Hacker / Penetration Tester (Web, Mobile, Infrastructure & Cloud Security) (Noida)
🏢 Piston Technologies Private
📍 Noida