We are looking for a Senior Security Engineer/Lead with robust hands-on experience in Application Security and VAPT, dedicated to Client's continuous security testing service (onsite preferred). The candidate will conduct security assessments across brand websites, mobile applications, APIs, internal and thick client applications, networks and enterprise environments, and review every bi-weekly website release before it goes live. The role requires expertise in manual and automated security testing, security tool management and client-facing engagement.

a. Conduct VAPT for web applications , mobile applications (Android/iOS), APIs, thick client applications and network infrastructure, external-facing assets and internal applications.

b. Perform cloud security assessments across AWS, Azure and GCP, including configuration reviews, IAM, storage security, network security and cloud-native services.

c.

Assess Active

Directory environments for misconfigurations, privilege escalation paths and security weaknesses, including the annual internal penetration test and segmentation testing between guest, PMS, building-systems and corporate zones.

d. Perform security configuration reviews of operating systems, databases, web servers, network devices and cloud infrastructure.

e. Identify, validate and prioritise vulnerabilities,



including vulnerability scan of internal and external IPs with manual validation and POC, and provide risk-based remediation recommendations.

f. Assess application architecture and design for security weaknesses and compliance with secure design principles, supporting architecture reviews.

g. Perform manual testing for OWASP Top 10, API Security Top 10, mobile security risks and business logic vulnerabilities (booking, payment, loyalty and offer flows), and report any WAF bypass.

h. Evaluate security risks of third-party libraries, containers and open-source components.

i. Collaborate with development, infrastructure, cloud and business teams to support remediation, and track every finding to closure.

j. Conduct vulnerability revalidation and closure verification.

k. Mentor junior team members and contribute to security methodologies, checklists and best practices.

In-depth knowledge of cloud assessment, AI/LLM-based pentest, agentic AI testing, mobile app, thick client, SAST/DAST, secure code review, Active Directory and configuration review.

Certifications: CEH, eJPT, eWPTx, CREST (any 2); AWS Certified Security Specialty; Microsoft Azure Security Engineer Associate (AZ-500); CCSK or CCSP.

📌 Security Architect (Bengaluru)
🏢 Cyberpwn
📍 Bengaluru