Analyst

Deloitte Shared Services India; New Delhi; On-site; INR 800,000 - 1,200,000; Full time

Job summary

Deloitte Shared Services India is seeking a cybersecurity professional with 1–5 years of hands-on VAPT and penetration testing experience across web applications, APIs, mobile, thick clients, and infrastructure environments.

The role emphasizes identifying vulnerabilities (SQLi, XSS, CSRF, IDOR, auth flaws) and conducting risk assessments, with reporting and remediation recommendations using OWASP Top 10 and related standards. Strong Linux/Unix and networking skills are required.

Qualifications

• 1–5 years hands-on VAPT and pen testing across Web/API/Mobile/Network environments.
• Identify and validate vulnerabilities including SQLi, XSS, CSRF, IDOR, auth, and logic flaws.
• Familiarity with OWASP Top 10, API Top 10, CVE/CWE, NIST and ISO 27001 concepts.

Responsibilities

• Perform VAPT across web, API, mobile, thick-client, network and infrastructure.
• Conduct vulnerability scanning, exploitation, risk assessment and remediation revalidation.
• Prepare VAPT reports with PoC, CVSS, business impact and remediation guidance.
• Work with Linux/Unix environments and understand networking fundamentals.
• Apply security concepts per OWASP Top 10 and related standards.

Skills

VAPT / Penetration Testing

Web & API Security Testing

Infrastructure / Network VAPT

Linux / Unix

Networking & Protocols: TCP/IP, DNS, (

HTTP/HTTPS, FTP, SSH, SMTP, VPN

OWASP Top 10 / API Top 10

Vulnerability assessment, exploitation

Education

B.E./B.Tech, M.Tech in CSE/IT/ECE/ETC, or MCA

Tools

Burp Suite

OWASP ZAP

Nmap

Nessus

Metasploit

Wireshark

Acunetix

Netsparker

Postman

Job description

Role Overview

We are looking for a cybersecurity professional with 1-5 years of hands-on experience in VAPT and Penetration Testing across Web Applications, APIs, Mobile, Thick Client, and Infrastructure environments.

Key Responsibilities

• Perform Vulnerability Assessment & Penetration Testing (VAPT) across web, API, mobile, thick-client, network and infrastructure environments.
• Identify and validate vulnerabilities including SQL Injection, XSS, CSRF, IDOR, authentication/authorization flaws and business logic vulnerabilities.
• Conduct internal/external infrastructure testing covering servers, network devices, firewalls and VPNs.
• Perform vulnerability scanning, manual exploitation, risk assessment and remediation revalidation.
• Prepare VAPT reports with PoC, CVSS severity, business impact and remediation recommendations.
• Apply OWASP Top 10, OWASP API Top 10, CVE/CWE, NIST and ISO 27001 concepts.
• Work with Linux/Unix environments and demonstrate strong understanding of networking fundamentals and protocols.

Mandatory Technical Skills

• VAPT / Penetration Testing
• Web & API Security Testing
• Infrastructure / Network VAPT
• Linux / Unix
• Networking & Protocols: TCP/IP, DNS, HTTP/HTTPS, FTP, SSH, SMTP, VPN
• OWASP Top 10 / API Top 10
• Vulnerability assessment, exploitation & revalidation

VAPT Tools

Hands-on experience with Burp Suite, OWASP ZAP, Nmap, Nessus, Metasploit, Wireshark, Acunetix/Netsparker and Postman.

Preferred Certifications

• CEH Certified Ethical Hacker
• CCNA
• ISO 27001
• ISO 20000 / ISO 31000 / ISO 22301
• Other relevant offensive security certifications are an advantage.

Education

B.E./B.Tech, M.Tech in CSE/IT/ECE/E&TC, or MCA.