Cyber Analysts - Vulnerability Management and Penetration Testing

Tata Power; Navi Mumbai, Mumbai; On-site; INR 800,000 - 1,400,000; Full time

Job summary

Tata Power is seeking a security professional to lead vulnerability assessments and penetration testing using tools like Qualys, Nessus, Burp Suite, and Metasploit. You will prioritize findings, track remediation, and report progress to infrastructure and application teams to ensure timely fixes.

The role requires 2–3 years of relevant experience, strong knowledge of network protocols and cloud platforms, and the ability to produce executive-level security reports.

Qualifications

• 2–3 years of experience in vulnerability assessment, penetration testing, or red teaming.
• Proficient with common vulnerability scanning and testing tools.
• Experience writing technical and executive-level reports.
• Familiar with OWASP Top 10, MITRE ATT&CK, and related security frameworks.

Responsibilities

• Lead or participate in regular internal vulnerability scans using tools like Qualys, Tenable, Rapid7, etc.
• Prioritize findings based on risk context (CVSS, EPSS, asset value, threat intel).
• Track and report remediation progress; collaborate with infrastructure and application teams for timely fixes.
• Ensure compliance with internal SLAs for remediation (e.g., fix critical within 15 days).
• Develop and maintain dashboards, metrics, and KPIs for executive and operational reporting.
• Maintain the asset inventory and ensure full scan coverage.
• Perform or coordinate internal and external penetration testing for networks, web apps, APIs, and cloud services.
• Validate exploitability of critical vulnerabilities; provide PoC reports where required.

Skills

Vulnerability assessment

Penetration testing

Red teaming

Report writing

Scripting

Tools

Qualys

Nessus

Nexpose

Tenable.io

Burp Suite

Metasploit

Nmap

Nikto

Wireshark

OWASP ZAP

Job description

Role & responsibilities:

Lead or participate in the regular execution of internal vulnerability scans using tools like Qualys, Tenable, Rapid7, etc.

• Prioritize findings based on risk context (CVSS, EPSS, asset value, threat intel).
• Track and report remediation progress; work closely with infrastructure and application teams to ensure timely fixes.
• Ensure compliance with internal SLAs for remediation (e.g., fix critical within 15 days).
• Develop and maintain dashboards, metrics, and KPIs for executive and operational reporting.
• Maintain the asset inventory and ensure full scan coverage.
• Perform or coordinate internal and external penetration testing for networks, web applications, APIs, and cloud services.
• Validate exploitability of critical vulnerabilities; provide proof-of-concept (PoC) reports where required.

Preferred candidate profile:

2-3 years of experience in vulnerability assessment, penetration testing, or red teaming.

• VM Tools: Qualys, Nessus, Nexpose, Tenable.io
• Pentest Tools: Burp Suite, Metasploit, Nmap, Nikto, Wireshark, OWASP ZAP
• Solid understanding of network protocols, OS internals, web application security, and cloud platforms (AWS/Azure).
• Experience with OWASP Top 10, CWE, MITRE ATT&CK, and CISA KEV.
• Ability to write technical and executive-level reports.
• Scripting knowledge (e.g., Python, Bash, PowerShell) is a plus.
• Bug Bounty experience is a plus.
• Security Certifications: OSCP, eJPT, CEH, GPEN, GWAPT, CRTO, CEH