Senior VAPT Engineer

Mitigata™ - Full-Stack Cyber Resilience; Bengaluru; On-site; INR 900,000 - 1,500,000; Full time

Job summary

Mitigata is seeking a senior offensive security professional to lead complex penetration testing engagements across cloud, web, API, mobile, and internal networks. You will perform advanced testing techniques, mentor junior testers, and serve as the client’s technical anchor through debriefs and remediation.

The role requires strong hands-on experience, proven scoping skills, and exceptional client-facing abilities to drive successful security outcomes.

Qualifications

• 5+ years hands-on offensive security with a strong VAPT track record.
• Deep manual expertise across web, API, network and at least one of cloud, mobile or thick-client.
• Proven ability to scope engagements and estimate effort accurately.
• Experience mentoring/leading testers and reviewing their work.
• Strong client presence — can run a debrief and handle pushback.

Responsibilities

• Lead complex penetration testing engagements across cloud, web, API, mobile, thick-client and internal network testing.
• Perform advanced testing: privilege escalation, lateral movement and cloud attack paths.
• Be the client's technical anchor through debriefs and remediation.
• Maintain and raise the team's standards, checklists and reporting.

Skills

VAPT track record

Web security

API security

Network security

Cloud/mobile/thick-client

Engagement scoping

Mentoring testers

Client presence

Job description

At @Mitigata, you'll join the offensive security team that keeps client environments honest — leading the toughest pen-test engagements, scoping new work, owning the methodology, and mentoring the engineers coming up behind you.

About the role:

You'll lead complex engagements across cloud, web, API, mobile, thick-client and internal network testing; run advanced work like privilege escalation, lateral movement and cloud attack paths; be the client's technical anchor through debriefs and remediation; and keep the team's standards, checklists and reporting sharp.

What we're looking for:

• 5+ years hands‑on offensive security with a strong VAPT track record
• Deep manual expertise across web, API, network + at least one of cloud, mobile or thick-client
• Proven ability to scope engagements & estimate effort accurately
• Experience mentoring/leading testers and reviewing their work
• Strong client presence — can run a debrief and handle pushback

Nice to have:

• OSCP / OSCE / OSWE / CRTP / CRTO or comparable
• Red team / adversary emulation experience
• Source‑code review or DevSecOps exposure
• Published CVEs, talks, tooling or a research profile