Cyber Security Analyst (VAPT | Red Teaming | SAST)

Shieldbyte Infosec Pvt. Ltd.; Mumbai; Vor Ort; INR 800.000 - 1.600.000; Vollzeit

Zusammenfassung

ShieldByte Infosec Pvt. Ltd. in Mumbai seeks an experienced security testing professional to conduct manual and automated penetration testing across web apps, mobile apps, APIs, networks, cloud, and thick-client apps.

You will apply OWASP Top 10, MITRE ATT&CK, CVSS, and risk-based reporting to drive remediation actions and improve client security postures. Strong communication and reporting skills are essential.

Qualifikationen

• 1–8 years hands-on experience in VAPT, Red Teaming, and/or application security.
• Strong grasp of network, web, mobile, API, and cloud security fundamentals.
• Familiarity with tools such as Burp Suite, Nmap, Metasploit, Cobalt Strike, Nessus, BloodHound, Nuclei, Wireshark, and Checkmarx / Fortify / SonarQube / Semgrep.
• Scripting ability in Python, Bash, or PowerShell.
• Solid understanding of OWASP, MITRE ATT&CK, CVSS, and the secure SDLC.
• Strong report-writing and communication skills.
• Foundational / Senior: CompTIA Security+, CISSP, CISM (for senior candidates)

Aufgaben

• Conduct manual and automated penetration testing across web applications, mobile apps (Android/iOS), APIs, networks (internal/external), cloud (AWS/Azure/GCP), and thick-client applications.
• Perform vulnerability assessments aligned to OWASP Top 10, SANS 25, WSTG, MITRE ATT&CK, PTES, and NIST.
• Exploit, validate, and document findings with clear risk ratings (CVSS) and actionable remediation guidance.
• Retest and verify closure of reported vulnerabilities.
• Execute adversary-simulation and social-engineering engagements (phishing, physical, pretexting).
• Perform lateral movement, privilege escalation, persistence, and command-and-control (C2) operations.
• Emulate real-world TTPs mapped to the MITRE ATT&CK framework.
• Bypass security controls (EDR/AV/WAF) and assess detection & response maturity (purple teaming).
• Integrate SAST tools into CI/CD pipelines and support DevSecOps / secure SDLC practices.
• Identify insecure coding patterns and guide developers on secure remediation.
• Produce detailed technical and executive-level assessment reports.
• Present findings to clients and support remediation discussions.

Kenntnisse

VAPT / Red Teaming

Security fundamentals

Report writing

Communication

Scripting (Python/Bash/PowerShell)

Ausbildung

Security certifications (CompTIA Security+, CISSP, CISM)

Tools

Burp Suite

Nmap

Metasploit

Cobalt Strike

Nessus

BloodHound

Nuclei

Wireshark

Checkmarx

Fortify

SonarQube

Semgrep

Jobbeschreibung

ShieldByte Infosec Pvt. Ltd. is a CERT-In empanelled auditor and a leading cybersecurity company in India, specializing in Cyber Security, Data Privacy, and Information Security consulting and compliance audits. The company supports global clients across more than 20 countries, providing tailored security solutions built on trust and confidence. ShieldByte focuses on delivering high-quality, customized services that not only meet but aim to exceed client requirements. The organization emphasizes integrity, strong partnerships, exceptional customer service, and community leadership, while fostering professional growth for its team members.

Role Description:

• Conduct manual and automated penetration testing across web applications, mobile apps (Android/iOS), APIs, networks (internal/external), cloud (AWS/Azure/GCP), and thick-client applications.
• Perform vulnerability assessments aligned to OWASP Top 10, SANS 25, WSTG, MITRE ATT&CK, PTES, and NIST.
• Exploit, validate, and document findings with clear risk ratings (CVSS) and actionable remediation guidance.
• Retest and verify closure of reported vulnerabilities.
• Execute adversary-simulation and social-engineering engagements (phishing, physical, pretexting).
• Perform lateral movement, privilege escalation, persistence, and command-and-control (C2) operations.
• Emulate real-world TTPs mapped to the MITRE ATT&CK framework.
• Bypass security controls (EDR/AV/WAF) and assess detection & response maturity (purple teaming).
• Integrate SAST tools into CI/CD pipelines and support DevSecOps / secure SDLC practices.
• Identify insecure coding patterns and guide developers on secure remediation.
• Produce detailed technical and executive-level assessment reports.
• Present findings to clients and support remediation discussions.

Qualifications

• 1–8 years of hands-on experience in VAPT, Red Teaming, and/or application security.
• Strong grasp of network, web, mobile, API, and cloud security fundamentals.
• Familiarity with tools such as Burp Suite, Nmap, Metasploit, Cobalt Strike, Nessus, BloodHound, Nuclei, Wireshark, and Checkmarx / Fortify / SonarQube / Semgrep.
• Scripting ability in Python, Bash, or PowerShell.
• Solid understanding of OWASP, MITRE ATT&CK, CVSS, and the secure SDLC.
• Strong report-writing and communication skills.
• Foundational / Senior: CompTIA Security+, CISSP, CISM (for senior candidates)