Manager – VA / VAPT

Crisil; Hyderabad; In loco; INR 2.500.000 - 4.500.000; Tempo pieno

Descrizione del lavoro

Crisil is seeking a Manager – VA/VAPT to oversee the vulnerability assessment and penetration testing program across the organization, including managing external vendors, ensuring regulatory compliance, and delivering timely risk insights to leadership.

The role requires hands-on experience with VA/VAPT tools and a solid grasp of RBI/CERT-In/PCI-DSS standards, with the ability to drive secure SDLC practices and stakeholder collaboration.

Competenze

• 8–12 years total experience with 3+ years in vendor or team management.
• B.Tech / B.E. / M.Tech / MCA in Computer Science, IT, or related field.
• CEH, OSCP, CISSP, CISA or equivalent certifications.

Mansioni

• Oversee end‑to‑end VA/VAPT activities including vendor management and scope validation.
• Ensure regulatory alignment with RBI, CERT‑In and PCI‑DSS mandates.
• Develop dashboards and periodic risk summaries for senior management.
• Define VA/VAPT governance, testing frequency, and remediation SLAs.
• Coordinate with IT, apps, cloud, and business teams for risk mitigation.

Conoscenze

VA/VAPT

Vendor management

Regulatory compliance

Reporting & dashboards

Stakeholder management

Formazione

B.Tech / B.E.

M.Tech / MCA

CEH

OSCP

CISSP

CISA

Strumenti

Qualys

Fortify

WebInspect

Burp Suite

Descrizione del lavoro

Job Description: Manager – VA / VAPT (Vulnerability Assessment & Penetration Testing)

Location: Mumbai
Department: Information Security
Reports To: Manager– Application Security

Role Overview

The Manager / Assistant Manager – VA/VAPT will be responsible for overseeing the vulnerability assessment and penetration testing program across the organization. The role includes managing external vendors performing security testing, ensuring regulatory and internal policy compliance, handling day-to-day BAU activities, and preparing reports and dashboards for senior management and regulatory bodies. The ideal candidate will have hands‑on experience in vulnerability management tools, application security scanners, and a strong understanding of the regulatory landscape in BFSI.

Key Responsibilities

1. Vulnerability Management & Testing Oversight

• Coordinate and manage end‑to‑end VA/VAPT activities conducted by external vendors.
• Review and validate test scopes, methodologies, and deliverables.
• Track remediation progress and coordinate with application/infrastructure teams for closure of findings.
• Ensure testing frequency aligns with regulatory, internal, and client requirements.
• Validate false positives and maintain quality of vulnerability reports.

2. Compliance & Regulatory Alignment

• Ensure compliance with RBI, CERT‑In, PCI-DSS, and other regulatory security testing mandates.
• Maintain audit‑ready evidence and documentation for all VA/VAPT‑related activities.
• Support internal and external audits (including from parent company, clients, and regulators).
• Track and report on compliance posture related to vulnerability management.

3. Reporting & Metrics

• Develop and maintain vulnerability management dashboards and reports for CISO and management.
• Generate periodic risk summaries, trend analysis, and KPI/KRI reports.
• Maintain trackers for testing schedule, remediation status, and exceptions.

4. Process & Governance

• Define and continuously improve the VA/VAPT governance process, including scope definition, testing frequency, and remediation SLAs.
• Manage change requests and deviations in coordination with vendors and internal teams.
• Ensure adherence to secure SDLC principles and coordinate with DevSecOps initiatives.

5. Tools & Technical Proficiency

• Utilize and manage tools such as Qualys, OpenText Fortify, WebInspect, and Burp Suite Professional for internal scans and validation.
• Correlate and prioritize vulnerabilities based on criticality, exploitability, and asset sensitivity.
• Support automation and integration of vulnerability data into enterprise dashboards or ticketing systems.

6. Stakeholder Management

• Collaborate with IT, applications, cloud, and business teams to ensure timely risk mitigation.
• Act as primary liaison with VA/PT vendors and ensure SLA adherence.
• Present security posture updates to senior management and CISO.

Roles and Responsibilities

Key Responsibilities

1. Vulnerability Management & Testing Oversight

• Coordinate and manage end‑to‑end VA/VAPT activities conducted by external vendors.
• Review and validate test scopes, methodologies, and deliverables.
• Track remediation progress and coordinate with application/infrastructure teams for closure of findings.
• Ensure testing frequency aligns with regulatory, internal, and client requirements.
• Validate false positives and maintain quality of vulnerability reports.

2. Compliance & Regulatory Alignment

• Ensure compliance with RBI, CERT‑In, PCI-DSS, and other regulatory security testing mandates.
• Maintain audit‑ready evidence and documentation for all VA/VAPT‑related activities.
• Support internal and external audits (including from parent company, clients, and regulators).
• Track and report on compliance posture related to vulnerability management.

3. Reporting & Metrics

• Develop and maintain vulnerability management dashboards and reports for CISO and management.
• Generate periodic risk summaries, trend analysis, and KPI/KRI reports.
• Maintain trackers for testing schedule, remediation status, and exceptions.

4. Process & Governance

• Define and continuously improve the VA/VAPT governance process, including scope definition, testing frequency, and remediation SLAs.
• Manage change requests and deviations in coordination with vendors and internal teams.
• Ensure adherence to secure SDLC principles and coordinate with DevSecOps initiatives.

5. Tools & Technical Proficiency

• Utilize and manage tools such as Qualys, OpenText Fortify, WebInspect, and Burp Suite Professional for internal scans and validation.
• Correlate and prioritize vulnerabilities based on criticality, exploitability, and asset sensitivity.
• Support automation and integration of vulnerability data into enterprise dashboards or ticketing systems.

6. Stakeholder Management

• Collaborate with IT, applications, cloud, and business teams to ensure timely risk mitigation.
• Act as primary liaison with VA/PT vendors and ensure SLA adherence.
• Present security posture updates to senior management and CISO.

Qualifications & Experience

Manager – VA/VAPT

8–12 years total experience with 3+ years in vendor or team management

B.Tech / B.E. / M.Tech / MCA in Computer Science, IT, or related field

CEH, OSCP, CISSP, CISA, or equivalent

Key Skills & Competencies

• Strong understanding of web, mobile, and infrastructure vulnerabilities and mitigation techniques.
• Hands‑on exposure to Qualys, Fortify, WebInspect, and Burp Suite Professional.
• Familiarity with regulatory frameworks such as RBI, CERT‑In, PCI-DSS, ISO 27001.
• Strong analytical, documentation, and presentation skills.
• Ability to handle multiple stakeholders and manage testing across multiple business lines.
• Good understanding of secure SDLC and DevSecOps principles.

Soft Skills

• Excellent communication and coordination skills.
• Strong reporting and analytical mindset.
• Ability to work under pressure and manage tight timelines.
• Proven vendor and stakeholder management skills.