Immediate Hiring For VAPT (Face To face interview)

ContactX Resource Management Pvt Ltd; Pune District; On-site; INR 800,000 - 1,400,000; Full time

Job summary

ContactX Resource Management Pvt Ltd is seeking an experienced VAPT & AppSec engineer to assess web apps, APIs, mobile apps, and networks. You will perform manual and automated testing, identify vulnerabilities, and provide remediation guidance.

The role includes validating findings, preparing detailed security reports, and supporting security in SDLC and DevSecOps across cloud and on-prem systems.

Qualifications

• Experience in security testing of web apps, APIs, mobile apps, and networks.
• Ability to validate findings and provide remediation guidance.
• Knowledge of OWASP Top 10 and API Top 10.
• Familiar with CI/CD/DevSecOps security integration is a plus.
• Certifications such as OSCP/OSWE desirable.

Responsibilities

• Conduct VAPT for web apps, APIs, mobile apps, and networks.
• Perform penetration testing to identify vulnerabilities and misconfigurations.
• Validate findings and recommend remediation guidance.
• Prepare VAPT reports with PoCs, risk ratings, and evidence.
• Integrate security testing into CI/CD/DevSecOps pipelines.

Skills

Web security

API security

Network security

Penetration testing

Vulnerability assessment

OWASP Top 10

HTTP/HTTPS

TCP/IP

DNS

OAuth 2.0

JWT

Linux

Windows

Cloud security

SAST/DAST/SCA

Python

JavaScript

Bash

Report writing

Education

Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related discipline

Tools

Burp Suite

OWASP ZAP

Nmap

Nessus

Postman

SonarQube

Checkmarx

Fortify

Veracode

Snyk

Job description

Vulnerability Assessment and Penetration Testing (VAPT)

• Conduct manual and automated security assessments of web applications, REST APIs, mobile applications, and network infrastructure.
• Perform penetration testing to identify vulnerabilities, misconfigurations, and potential attack vectors.
• Validate findings, assess business impact, and recommend appropriate remediation measures.
• Perform retesting to verify that identified vulnerabilities have been successfully resolved.
• Prepare detailed VAPT reports with proof of concept, risk ratings, technical evidence, and remediation guidance.
• Conduct security assessments aligned with OWASP Top 10, OWASP API Security Top 10, and relevant industry standards.

Application Security (AppSec)

• Integrate security practices into the Software Development Life Cycle (SSDLC).
• Perform secure code reviews to identify common coding vulnerabilities and security weaknesses.
• Conduct SAST, DAST, Software Composition Analysis (SCA), and secrets scanning.
• Identify and assess vulnerabilities such as SQL injection, cross-site scripting (XSS), broken access control, authentication flaws, SSRF, insecure deserialization, and business logic vulnerabilities.
• Support threat modeling and security architecture reviews for new features and applications.
• Provide secure coding recommendations to developers and help validate remediation.

API and Mobile Application Security

• Assess API authentication, authorization, input validation, rate limiting, and data exposure risks.
• Perform security testing of Android and iOS applications, including static and dynamic analysis.
• Evaluate session management, cryptographic implementations, sensitive data storage, and communication security.
• Identify insecure integrations and third-party component risks.

Vulnerability Management and Reporting

• Maintain a vulnerability register and track findings through remediation and closure.
• Prioritize vulnerabilities based on severity, exploitability, business impact, and exposure.
• Work with development and infrastructure teams to establish remediation timelines.
• Track remediation SLAs and report vulnerability trends and security metrics.
• Support compliance and audit requirements related to application security and penetration testing.

Security Automation and Collaboration

• Integrate security testing tools into CI/CD pipelines and DevSecOps workflows.
• Help reduce false positives and improve the effectiveness of security testing.
• Collaborate with developers, QA, DevOps, and architecture teams to resolve security issues.
• Conduct security awareness sessions and provide guidance on secure development practices.
• Stay updated on emerging vulnerabilities, attack techniques, CVEs, and security testing methodologies.

Required Technical Skills

• Strong understanding of web application, API, and network security.
• Hands-on experience with penetration testing and vulnerability assessment methodologies.
• Knowledge of OWASP Top 10, OWASP API Security Top 10, and common application security vulnerabilities.
• Experience with tools such as Burp Suite Professional, OWASP ZAP, Nmap, Nessus, and Postman.
• Familiarity with SAST, DAST, and SCA tools such as SonarQube, Checkmarx, Fortify, Veracode, or Snyk.
• Understanding of HTTP/HTTPS, TCP/IP, DNS, TLS, authentication, authorization, OAuth 2.0, and JWT.
• Experience with Linux, Windows, web technologies, databases, and cloud application security fundamentals.
• Ability to document security findings and communicate technical risks clearly.
• Basic scripting or programming skills in Python, JavaScript, Bash, or similar languages.

Preferred Qualifications

• Experience with mobile application security testing using tools such as MobSF, Frida, or JADX.
• Knowledge of cloud security across AWS, Azure, or GCP.
• Familiarity with container security, Docker, Kubernetes, and CI/CD pipeline security.
• Experience with threat modeling methodologies such as STRIDE.
• Knowledge of secure coding practices and common vulnerabilities in Java, Python, JavaScript, or .NET applications.
• Certifications such as OSCP, OSWE, eWPTX, CEH, Security+, or equivalent practical experience.

Educational Qualifications

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related discipline.
• Relevant hands-on cybersecurity experience may be considered in place of specific certifications.

Key Competencies

• Strong analytical and problem-solving skills.
• Attention to detail and a methodical approach to security testing.
• Ability to distinguish exploitable vulnerabilities from false positives.
• Clear technical report writing and stakeholder communication.
• Ability to work independently and collaboratively in a fast-paced environment.
• Commitment to ethical testing and responsible vulnerability disclosure