Senior Security Consultant - Attack & Pentest

Varutra; Hyderabad; On-site; INR 800,000 - 1,200,000; Full time

Job summary

Varutra in Hyderabad is looking for a skilled security expert specializing in Application and Network Penetration Testing. The role involves conducting thorough security assessments, creating test cases, and performing source code reviews. Candidates should be well-versed in Cloud Security for platforms like AWS and Azure, with a solid understanding of OWASP standards. Expertise in tools such as Burp Suite and IBM AppScan is preferred, along with the ability to present findings effectively to stakeholders.

Qualifications

• Must have Cloud Security and Penetration Testing skills, especially in web and mobile applications.
• Familiarity with OWASP Top Ten and application security concepts is required.
• Experience in vulnerability assessments and reporting is essential.

Responsibilities

• Conduct Application Penetration Testing and Network Security assessments.
• Create test cases and perform source code reviews.
• Report findings to stakeholders and present the impact of security vulnerabilities.

Skills

Cloud Security

AWS and Azure

GCP

VAPT

Web application Security

Mobile application Security

API Testing

Tools

Burp suite

OWASP ZAP

IBM AppScan

Nessus

Job description

Skills: Mandatory Skills: Cloud Security, AWS and Azure, GCP, Oracle domain
Cloud Application Pentest, (Network Pentest, Architecture Review for Infrastructure and Application, Cloud Security Configuration Review, Network Security Architecture Review and Red Teaming).
Other skills: VAPT, Web application Security, Mobile application Security, Network Security, API Testing.

Job Description:

The major focus will be on Application Penetration testing followed by Network Penetration Testing and Mobile Security assessments, Red Team Assessment, Phishing, IoT, Cloud Pen testing (Azure and AWS, Google Cloud), Cloud Configuration Audit, Architecture Review.

• The work involves Test Case Creation, Penetration Testing, Source code reviews, Report Creation & presentation to stakeholders along with operation and construction of tools to assist in these tasks.
• Well versed with OWASP Top Ten and WASC Threat Classifications.
• Expertise in Vulnerability Assessment and Penetration Testing of Web Applications.
• Business‐Logic based application testing.
• Penetration testing of Mobile applications and websites.
• Exploitation of the issues found and presenting the impact occurred.
• Source Code Reviews Well versed in Java Secure Code Review.
• Well versed in OWASP Code Review concepts & identifiers.

Familiar with popular tools:

• Application Proxy: Burp suite, Paros, OWASP ZAP, WireShark, Vulnerability Scanners: IBM AppScan, HP WebInspect, Nessus, NTO Spider.
• Understanding of the nature and sources of security vulnerabilities, how to identify and exploit
• Sound Knowledge of TCP/IP protocol Stack, HTTP protocol, encoding standards, encryption technologies and development frameworks.

Skills Mandatory:

• Application Security Testing/Penetration Testing (Web-based, Thick client, web services, Mobile.
• Network Security Testing/Penetration Testing (Network, OS, Databases etc).
• Static Code Analysis/ Secure Code Review.