Information Security Consultant

eSec Forte; Gurugram District; On-site; INR 700,000 - 1,100,000; Full time

Benefits offered by this job

Health insurance for employee

Certification reimbursement

Learning & development allowance

Conference / training attendance

Flexible work arrangements

Job summary

eSec Forte Technologies in Gurugram is seeking an Information Security Consultant to perform detailed security assessments and penetration testing on web applications and APIs. You will identify vulnerabilities, analyze impact, and provide actionable remediation guidance to strengthen client security postures.

The role requires 1–5 years of experience in information security, hands-on testing with Burp Suite, and collaboration with client teams.

Qualifications

• 1–5 years in information security with focus on web app and API testing.
• Solid knowledge of OWASP Top 10 and common vulnerabilities.
• Experience with Burp Suite and security testing tools.
• Ability to report findings clearly with remediation guidance.
• Familiarity with Java, Python, .NET, or Node.js.

Responsibilities

• Perform penetration testing on web apps and APIs.
• Identify vulnerabilities and assess risk levels.
• Develop detailed remediation recommendations.
• Collaborate with client development and security teams.
• Stay updated on emerging attack vectors and best practices.

Skills

Burp Suite

OWASP Top 10

API testing

Web app testing

Python

Java

Education

Any graduate degree

Tools

Burp Suite

Invicti

HCL AppScan

Checkmarx

Snyk

Job description

Department: Security Services · SS-2026-001# Information Security ConsultantGurugram On-site 1-5 yrs InternalFull Time## Job Description### About the RoleAs an Information Security Consultant, you will conduct detailed security assessments and penetration tests for client web applications and APIs. This involves identifying vulnerabilities, analyzing their impact, and providing actionable remediation guidance to enhance the security posture of critical digital assets.### Key Responsibilities* Perform comprehensive penetration testing on web applications and APIs using industry-standard methodologies and frameworks.* Identify and exploit a wide range of vulnerabilities, including OWASP Top 10, business logic flaws, authentication bypasses, and authorization issues.* Utilize security testing tools such as Burp Suite (PortSwigger) for in-depth analysis, traffic manipulation, and exploitation.* Conduct static and dynamic application security testing (SAST/DAST) using platforms like Invicti (Netsparker) or HCL AppScan when appropriate for client engagements.* Develop detailed, technically accurate reports outlining identified vulnerabilities, their associated risk levels, and practical, prioritized remediation recommendations.* Collaborate directly with client development and security teams to explain technical findings, demonstrate exploit scenarios, and guide them through effective patching strategies.* Stay abreast of emerging web application and API attack vectors, security best practices, and evolving industry standards.### Requirements* 1-5 years of experience in information security, with a dedicated focus on web application and API penetration testing.* Any graduate degree.* Demonstrated proficiency in performing security assessments for both web applications and APIs.* Solid understanding of common web vulnerabilities (e.g., OWASP Top 10, SANS Top 25) and their exploitation techniques.* Hands-on experience with industry-standard security testing tools, particularly Burp Suite (PortSwigger).* Ability to articulate complex technical issues and remediation strategies clearly and concisely in both written reports and verbal presentations.* Familiarity with various programming languages and frameworks commonly used in web and API development (e.g., Java, Python, .NET, Node.js).### Nice-to-Have* Experience with automated DAST/SAST tools such as Invicti (Netsparker), HCL AppScan, Checkmarx, or Snyk.* Familiarity with security testing for cloud-native applications or microservices architectures on platforms like AWS, Azure, or GCP.* Scripting skills (e.g., Python, PowerShell) for automating testing tasks or developing custom exploits.* Knowledge of mobile application security testing principles.### Benefits* Health insurance for the employee and dependents* Professional security-certification reimbursement (e.g., OSWE, GWAPT, CEH)* Annual learning and skill-development allowance* Sponsored conference / training attendance* Flexible work arrangements## About eSec Forte TechnologieseSec Forte Technologies is an ISO 27001, ISO 9001, and CMMi Level 3 certified global cybersecurity and digital forensics company, and a global PCI DSS QSA. Headquartered in India, Singapore, and the United States, we deliver full-spectrum security services — consulting, managed security operations, security engineering and implementation, compliance assessment, offensive security testing, and digital forensics — to Fortune 500 enterprises, government bodies, and emerging-growth clients across 20+ countries.ISO 9001:2015 certifiedISO 27001:2022 certifiedCMMi Level 3 certifiedCERT-In empaneled for information security auditing servicesGlobal PCI DSS QSA (Qualified Security Assessor, authorized by PCI SSC)### Clients* Fortune 500 enterprises* Government and public-sector bodies* Emerging-growth and high-scale companies* Clients across 20+ countries### Delivery locationsDelhi (HQ) · Gurugram · Bengaluru · Mumbai · Sri Lanka · Singapore · United States### Job DetailsOpenings: 1Anu graduate### Required Skillsweb application testing and api testing