Senior Security Analyst

Sq1; Chennai, Tiruchirappalli, Coimbatore District, Bengaluru, Hyderabad; On-site; INR 2,200,000 - 4,000,000; Full time

Job summary

SQ1 Security Technology Private Limited is seeking a Senior Security Analyst with 6-7 years of hands-on VAPT experience across web, API, mobile apps, and infra. The role covers manual testing, vulnerability validation, and remediation guidance, with client handling and end-to-end assessment ownership.

You will lead technical assessments, mentor juniors, and conduct testing for AI/LLM based applications, while delivering high-quality reports and security recommendations to clients.

Qualifications

• Hands-on vulnerability assessment and penetration testing across web apps, APIs, mobile apps, and infra.
• Strong ability to articulate findings, risks, and remediation plans to clients and stakeholders.
• Experience leading assessments and mentoring junior analysts.

Responsibilities

• Conduct manual and automated pentests of web apps, APIs, mobile apps, and infrastructure.
• Identify OWASP Top 10, API security risks, and IA/AI security vulnerabilities.
• Lead client discussions, document findings, and guide remediation efforts.

Skills

Manual testing

VAPT

Client handling

Technical reporting

Mentoring

AI/LLM security

Python scripting

Education

Bachelor's degree in CS/IT/Cybersecurity

Tools

Burp Suite Pro

Nmap

Nessus/Qualys

MobSF

JADX

Frida

objection

apktool

ADB

Job description

SQ1 Security Technology Private Limited | Full time

We are looking for a highly skilled Senior Security Analyst with 6-7 years of hands-on experience in Vulnerability Assessment and Penetration Testing (VAPT) across web applications, APIs, mobile applications (Android/iOS), internal and external infrastructure, and AI-powered applications.

The candidate must have strong expertise in manual penetration testing, vulnerability validation, exploitation, security reporting, and remediation guidance. Client handling, technical reporting, and the ability to independently manage end-to-end security assessments are mandatory requirements.

The ideal candidate should be capable of leading technical assessments, communicating findings to clients and stakeholders, mentoring junior team members, and conducting security testing of AI/LLM-based applications and integrations.

Key Responsibilities

1. Web Application and API Penetration Testing

Conduct manual and automated penetration testing of web applications, REST/SOAP APIs, and GraphQL endpoints.

Identify and validate vulnerabilities related to authentication, authorization, access control, injection, SSRF, XSS, CSRF, IDOR/BOLA, business logic, file uploads, and privilege escalation.

Assess JWT, OAuth 2.0, session management, API keys, rate limiting, and sensitive data exposure.

Perform in-depth testing aligned with OWASP Top 10, OWASP API Security Top 10, and OWASP Web Security Testing Guide.

Identify complex attack chains and business logic vulnerabilities that automated scanners may miss.

Perform static and dynamic security testing of Android APK and iOS IPA applications.

Analyze application binaries, configurations, permissions, local storage, cryptographic implementations, and network communications.

Identify insecure data storage, hardcoded secrets, certificate validation weaknesses, insecure deep links, WebView issues, and runtime vulnerabilities.

Use tools such as MobSF, JADX, apktool, ADB, Frida, objection, and Burp Suite.

Validate mobile application vulnerabilities and assess associated backend API security.

3. Internal and External Infrastructure Penetration Testing

Conduct infrastructure VAPT across servers, endpoints, network devices, VPNs, and externally exposed services.

Perform network discovery, service enumeration, vulnerability validation, exploitation, and privilege escalation testing.

Assess Windows, Linux, Active Directory, domain controllers, and common enterprise services.

Identify misconfigurations, weak authentication, excessive privileges, insecure protocols, outdated software, and network segmentation weaknesses.

Perform authorized Active Directory security assessments, including privilege escalation paths, Kerberoasting exposure, and insecure delegation.

Use tools such as Nmap, Nessus, Qualys, BloodHound, Impacket, and NetExec.

4. AI and LLM Application Penetration Testing

Conduct security assessments of AI-powered applications, LLM integrations, chatbots, AI agents, and retrieval-augmented generation (RAG) systems.

Test for direct and indirect prompt injection, system prompt disclosure, insecure tool invocation, excessive agency, and unauthorized actions.

Assess sensitive information disclosure, insecure output handling, improper access controls, and cross-user data leakage.

Test RAG pipelines for document-level authorization weaknesses, data leakage, and malicious content injection.

Assess AI application integrations, plugins, external tools, APIs, and agent permissions for security weaknesses.

Evaluate risks associated with insecure output handling, denial-of-service, resource consumption, and model abuse.

Apply relevant guidance from the OWASP Top 10 for LLM Applications and other applicable AI security testing frameworks.

Document attack scenarios, business impact, reproducible proof of concept, and practical mitigation measures.

5. Client Handling and Stakeholder Management — Mandatory

Independently handle client communications throughout the assessment lifecycle.

Conduct technical kickoff meetings, scope discussions, requirement gathering, and rules-of-engagement reviews.

Explain technical findings, business impact, severity ratings, and remediation priorities to technical and non-technical stakeholders.

Participate in client review meetings, vulnerability walkthroughs, remediation discussions, and closure meetings.

Respond to client queries, clarify findings, provide supporting evidence, and defend technical conclusions with appropriate proof of concept.

Coordinate with development, infrastructure, and security teams to support remediation and retesting.

Manage client expectations, assessment timelines, dependencies, and deliverables professionally.

6. Technical Reporting and Documentation — Mandatory

Prepare high-quality VAPT reports covering executive summaries, scope, methodology, findings, evidence, severity ratings, impact, and remediation recommendations.

Write clear and reproducible technical findings supported by screenshots, request/response evidence, commands, and proof of concept where appropriate.

Assign severity using CVSS and business context, ensuring risk ratings are justified.

Provide practical remediation recommendations tailored to the affected technology and vulnerability.

Prepare consolidated reports for web applications, APIs, mobile applications, infrastructure, and AI security assessments.

Review reports for technical accuracy, consistency, completeness, duplication, and false positives before client delivery.

Prepare retest reports and validate remediation effectiveness.

7. Assessment Ownership and Technical Leadership

Independently plan and execute end-to-end penetration testing engagements.

Define testing approaches, prioritize high-risk areas, and adapt methodologies to different environments.

Review vulnerability findings and technical reports prepared by junior analysts.

Mentor junior team members on manual testing, exploitation techniques, evidence collection, and reporting standards.

Support effort estimation, project planning, assessment tracking, and delivery quality.

Keep up to date with emerging vulnerabilities, exploitation techniques, AI security risks, and penetration testing methodologies.

Required Technical Skills

Strong hands-on experience in manual web application, API, mobile, and infrastructure penetration testing.

Practical understanding of OWASP Top 10, OWASP API Security Top 10, OWASP MASVS/MASTG, and relevant AI/LLM security risks.

Experience with Burp Suite Professional, Nmap, Nessus/Qualys, MobSF, JADX, Frida, objection, and infrastructure testing tools.

Working knowledge of Windows, Linux, Active Directory, TCP/IP, common network services, and privilege escalation techniques.

Understanding of authentication mechanisms, cryptography, HTTP/HTTPS, REST APIs, JWT, OAuth 2.0, and application architectures.

Practical understanding of LLMs, prompt injection, RAG architectures, AI agents, tool calling, and AI application security testing.

Scripting skills in Python, Bash, or PowerShell for testing and automation.

Strong technical writing, analytical thinking, and troubleshooting skills.

Mandatory Professional Competencies

Proven ability to handle clients independently and professionally.

Strong technical reporting and presentation skills.

Ability to explain complex vulnerabilities and security risks to different audiences.

Capability to manage multiple assessments and deliver within agreed timelines.

Strong ownership, ethical conduct, attention to detail, and adherence to approved scope.

Ability to work independently while guiding and supporting junior analysts.

Qualifications and Certifications

Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related discipline, or equivalent practical experience.

6-7 years of relevant hands-on penetration testing experience.

Certifications such as OSCP, OSWE, BSCP, CRTO, PNPT, eWPT, eMAPT, or equivalent are desirable.

Relevant AI security training or practical experience in LLM application testing is an added advantage.

Key Performance Indicators (KPIs)

Technical quality and completeness of assessment reports.

Accuracy of vulnerability validation and severity ratings.

Client satisfaction and effectiveness of technical communication.

Timely delivery of assessments and reports.

Effectiveness of remediation guidance and retesting.

Ability to independently manage engagements and resolve technical challenges.

Quality of technical reviews and mentoring provided to junior team members.

Important: Candidates must demonstrate practical manual penetration testing skills, independent client handling, and strong reporting capabilities. Experience limited to automated scanning without manual validation will not meet the requirements of this role.