Assistant Manager / Manager - Cyber Security - VAPT

BDO India; Mumbai; On-site; INR 1,200,000 - 2,000,000; Full time

Job summary

BDO India, a leading professional services network, seeks an experienced security testing professional to perform VAPT for web, mobile, and APIs. You will assess vulnerabilities, run tests using Burp Suite, ZAP, Nessus, and Wireshark, and report findings with actionable remediation guidance.

You will collaborate with clients to strengthen security postures, align with regulatory practices, and stay current with evolving threats and controls.

Qualifications

• 3-7 years of experience in VA & PT, Web Application Testing, API Testing, and Mobile Application Testing.
• Hands-on with Burp Suite, OWASP ZAP, Nessus, Wireshark.
• Familiarity with OWASP Top 10 and API security testing.

Responsibilities

• Perform Vulnerability Assessment and Penetration Testing for web, mobile, and APIs.
• Conduct web app testing including XSS/SQLi and OWASP Top 10 risks.
• Test mobile apps for security compliance and vulnerabilities.
• Perform API testing for RESTful and SOAP APIs.
• Prepare vulnerability reports with remediation recommendations.
• Keep updated with latest cybersecurity trends and tools.

Skills

VAPT experience

Web testing

API testing

Mobile testing

Security testing

Tools

Burp Suite

OWASP ZAP

Nessus

Wireshark

Job description

BDO is a global network of professional services firms with a presence in over 166 countries, revenue of over USD 14 billion, and experience of over 60 years. It’s a leading service provider for the mid-markets with client service at its heart.

BDO India Services Private Limited (or ‘BDO India’) is the India member firm of BDO International. BDO India offers strategic, operational, accounting and tax, and regulatory advisory & assistance for both domestic and international organizations across a range of industries. BDO India is led by more than 300+ Partners & Directors with a team of over 10,000 professionals operating across 14 cities and 20 offices. We expect to grow sizably in the coming 3-5 years, adding various dimensions to our business and multiplying and increasing the current team size multi-fold.

About Cyber

BDO India cyber security practice is one of the fastest growing areas of the business with significant ambition for the future through additional recruitment and acquisition. As part of our cyber team / tech risk you will be managing teams and projects delivering advisory and technical support to help our clients to improve their information / cyber security posture and respond to the dynamic nature of technology risks / cyber security threats. You will provide security domain expertise and utilize your business insight to work closely with our clients to advise, design, build and deploy pragmatic security solutions that will provide real and tangible benefits to protect their organizations. Furthermore, often carryout out IT Risk Assessments in line with industry “better” practices (NIST / ISF / Cloud Security / etc.), regulatory mandates (RBI / IRDAI), and various compliance standards focusing on data security, data privacy, etc.

Must-Have Qualifications:

• 3-7 years of experience in both VA & PT, Web Application Testing, API Testing, and Mobile Application Testing.
• Hands-on experience with security tools such as Burp Suite, OWASP ZAP, Nessus, and Wireshark.
• Familiarity with common vulnerabilities (OWASP Top 10) and security testing methodologies.
• Solid understanding of API security (REST, SOAP) and tools for testing API security.
• Certifications such as CEH (Certified Ethical Hacker), OSCP (Offensive Security Certified Professional), or other relevant cybersecurity certifications are highly preferred.
• Strong problem-solving skills and ability to work under pressure.

Key Responsibilities:

• Perform Vulnerability Assessment and Penetration Testing (VAPT) for web applications, mobile applications, and APIs to identify potential security risks.
• Conduct Web Application Testing including static and dynamic analysis, identifying vulnerabilities such as SQL injection, cross-site scripting (XSS), and other OWASP Top 10 risks.
• Test Mobile Applications (Android and iOS) to ensure compliance with security standards and identify vulnerabilities.
• Perform API Testing to evaluate the security of RESTful and SOAP APIs.
• Conduct risk assessments and security audits to identify vulnerabilities, potential threats, and recommend mitigations.
• Collaborate with internal teams to implement secure coding practices and improve overall application security.
• Assist in preparing detailed vulnerability reports, providing clear recommendations for remediation.
• Keep up to date with the latest trends, tools, and methodologies in cybersecurity.