Cyber Security Engineer – Application VAPT

Staunch Technologies Pvt Ltd.; Chennai; Hybrid; INR 600,000 - 800,000; Full time

Job summary

Staunch Technologies Pvt Ltd in Chennai, India, seeks a Cyber Security Engineer with at least 1 year hands-on experience in Application VAPT. You will assess web apps, APIs, and mobile platforms, and report vulnerabilities.

The role requires a solid understanding of secure coding concepts, familiarity with Burp Suite, OWASP Top 10, and the ability to collaborate with development teams to remediate findings.

Qualifications

• Bachelor’s degree in CS/IT or related field.
• Minimum 1 year of app-level penetration testing experience.
• Proficiency with security testing tools such as Burp Suite Pro, OWASP ZAP, Postman, Nmap, Nessus, SQLmap, or Metasploit.
• Deep understanding of HTTP protocols, web architectures, and session management.
• CEH/eWPT/OSCP progress preferred but not mandatory.

Responsibilities

• Perform manual and automated vulnerability assessments on web applications, mobile apps, and APIs.
• Identify security flaws using OWASP Top 10 and SANS Top 25 frameworks.
• Assist in static (SAST) and dynamic (DAST) testing integrations within the development pipeline.
• Write clear VAPT reports with PoCs and remediation guidance.
• Collaborate with development teams to implement fixes and secure coding practices.

Skills

Penetration testing

Security tooling

VAPT

Web security

Education

B.E./B.Tech (CS/IT)

BCA

MCA

Tools

Burp Suite Pro

OWASP ZAP

Postman

Nmap

Nessus

SQLmap

Metasploit

Job description

Cyber Security Engineer – Application VAPT

Staunch Technologies Pvt Ltd

Experience: 1+ Years Full-time Chennai, India (or Remote/Hybrid as applicable)

• Position: Cyber Security Engineer (Application VAPT)
• Experience: 1+ Years
• Location: Chennai, India (or Remote/Hybrid as applicable)
• Department: Information Security / Cyber Security Operations
• Reports To: Lead Security Engineer / CISO

Job Summary

We are seeking an analytical and driven Cyber Security Engineer with at least 1 year of hands-on experience dedicated to Application-level Vulnerability Assessment and Penetration Testing (VAPT). In this role, you will be responsible for identifying, evaluating, and reporting security vulnerabilities across our web applications, APIs, and mobile platforms. The ideal candidate has a foundational understanding of secure coding concepts, is fluent with industry-standard penetration testing tools, and can clearly articulate security risks to development teams.

Application VAPT Operations

• Security Testing: Perform manual and automated vulnerability assessments and penetration testing on web applications, mobile apps (iOS/Android), and APIs (REST/GraphQL).
• Threat Identification: Identify security flaws using the OWASP Top 10 and SANS Top 25 frameworks (such as SQL Injection, XSS, CSRF, Authentication Bypasses, and Business Logic Flaws).
• Source Code Review: Assist in static (SAST) and dynamic (DAST) application security testing integrations within the development pipeline.

Reporting & Remediation Support

• Technical Reporting: Write clear, concise, and structured VAPT reports documenting found vulnerabilities, their technical impact, proof-of-concepts (PoCs), and step-by-step remediation advice.
• Developer Collaboration: Work directly with software development teams to explain vulnerabilities and guide them through patch implementation and secure coding practices.
• Re-testing: Conduct verification testing to ensure that identified vulnerabilities have been successfully remediated and patched.

Required Skills & Qualifications

• Education: Bachelor’s degree in B.E. / B.Tech (Computer Science, IT), BCA, MCA, or a related technical field.
• Experience: Minimum 1 year of professional experience explicitly performing application-level penetration testing.
• Tooling Expertise: Proficiency with security testing tools such as Burp Suite Pro, OWASP ZAP, Postman, Nmap, Nessus, SQLmap, or Metasploit.
• Technical Concepts: Deep understanding of HTTP protocols, web architectures, session management, and cryptographic concepts.
• Certifications (Preferred but not mandatory): CEH (Certified Ethical Hacker), eWPT (eLearnSecurity Web Application Penetration Tester), or initial progress toward OSCP.