Senior Consultant - VAPT | Web & Mobile Application Security

EY; Ernakulam, Thiruvananthapuram, Bengaluru; On-site; INR 1,500,000 - 2,500,000; Full time

Job summary

EY is seeking a Senior IT Infrastructure Assessment professional to join diverse consulting engagements with substantial travel to the Middle East. You will perform infrastructure and AD security assessments, web/mobile/API testing, and vulnerability management across complex environments.

The ideal candidate has 3+ years in core IT security assessment, hands-on use of Kali, Burp Suite, Nessus, and scripting with Python/PowerShell.

Qualifications

• Qualification required: MCA/BTech/BSc (Comp Science/Electronics and communication, or equivalent).
• Minimum 3+ years of core IT infrastructure security assessment & penetration testing experience.

Responsibilities

• Engage in diverse consulting assignments with a readiness to travel to Middle East regions for project delivery (~50% of time).
• Perform infrastructure penetration testing and vulnerability assessments, Active Directory assessments, and Wireless network testing.
• Conduct security code reviews, log analysis, and secure SDLC/OWASP practices; prepare management-ready observations.

Skills

Network Security Assessment

Penetration Testing

Web App Pen Testing

API Security Assessment

AD Security Assessments

Vulnerability Management

Wireless Penetration Testing

Kali

Burp Suite

Nessus

Qualys

PowerShell

Python

Education

MCA

BTech

BSc CS/EC

Tools

Kali

Burp Suite

Nessus

Qualys

PowerShell

Python

Job description

Job Title : IT Infrastructure Assessment (Senior)

Qualification required: MCA/BTech /BSc ( Comp Science/Electronics and communication, or equivalent)

Qualification — preferred: Minimum 3+ years of core IT infrastructure security assessment & penetration testing experience

Skills — required: Network and Infrastructure Security Assessment and Penetration Testing, Web and Mobile Application Penetration Testing, API Security Assessment, AD Security Assessments, Vulnerability Management, Wireless Penetration Testing.

Skills — preferred:

• Red Teaming, Social Engineering Assessments, Purple Teaming, Physical Security, Secure Code Review
• Hands-on Experience with findings remediation and security log analysis

Job description

The candidate would be expected to work in diverse consulting engagements and are willing to travel to Middle East countries for project execution atleast 50% of their time. The candidate are expected to have experience / knowledge with respect to the following:

• Experience with infrastructure penetration testing and vulnerability assessments
• Experience with Active directory assessments
• Experience with Wireless Network Penetration testing
• Good knowledge of encryption technologies & MiTM attacks
• Knowledge of Linux administration, TCP/IP, DNS and Network protocols
• Good understanding of AD administration, different authentication mechanisms, trust boundaries etc.
• Good knowledge of OSI model, OWASP and Secure SDLC standards
• Should have performed web/mobile/API penetration testing.
• Experience in performing security code reviews and log analysis.
• Experience in performing security configuration reviews for OS, Databases, Network & Security devices, applications etc.
• Hands on experience will tools/frameworks like Kali, Burp Suite, Nessus, Qualys etc.
• Hands on experience with programming using Python/Perl/PowerShell/C#
• Hands on experience with open-source C2 frameworks
• Hands on experience with setting‑up phishing and performing social engineering assessments
• Experience with AV evasion, obfuscation, bypass windows ASR/device guard, network security controls, emails gateway filtering etc
• Review operational logs and event console activity to determine cause of security-related events or to identify potential security related events
• Analysis of the patches released by the vendors
• Good in report writing and convey the observations to the top management in layman’s language emphasizing on the business risks.
• Experience with mentoring junior resources or managing a group of resources.

Preferred certifications : OSCP, GPEN, OSWE, OSWP, LPT, ECSA, CEH, RHCE, CCNA, CompTIA Security+