Support Lead

HCL Technologies Limited; Pune District; On-site; INR 1,800,000 - 3,000,000; Full time

Job summary

HCLTech seeks a Security Testing & Vulnerability Assessment Engineer to safeguard enterprise apps, cloud platforms, APIs and GenAI solutions. You will conduct hands-on VAPT, cloud security reviews and compliance validation with DevOps, cloud, AI/ML, and security teams to maintain a strong security posture.

The role emphasizes OWASP Top 10 testing, risk assessments, and reporting with remediation guidance across multi-cloud environments.

Qualifications

• 5+ years of experience in Vulnerability Assessment and Penetration Testing.
• Hands-on cloud security assessments and AI security testing.
• Experience with OWASP Top 10 and threat modeling.
• Strong knowledge of secure development practices.

Responsibilities

• Perform vulnerability assessments and penetration testing for web apps, APIs, cloud environments, and enterprise systems.
• Conduct secure code reviews, DAST, and SAST.
• Evaluate OWASP Top 10 risks and validate security controls.
• Assess cloud configurations across AWS, Azure, and GCP.
• Develop AI/GenAI security test scenarios and threat models.

Skills

VAPT

Security Testing

OWASP Testing

Cloud Security

AI Security Testing

Penetration Testing

Threat Modeling

Secure SDLC

DevSecOps

Education

Bachelor's or Master's degree in Cybersecurity/Information Security

Tools

Nessus

Qualys

Burp Suite

OWASP ZAP

Nmap

OpenVAS

Rapid7 InsightVM

Job description

Security Testing & Vulnerability Assessment Engineer (VAPT) – Cloud & AI Security

Job Summary

We are seeking a highly skilled Security Testing & Vulnerability Assessment Engineer with expertise in Vulnerability Assessment and Penetration Testing (VAPT), OWASP Security Testing, Security Compliance, Vulnerability Management, AI Security Testing, and Cloud Security Assessments. The ideal candidate will be responsible for identifying, assessing, and mitigating security vulnerabilities across enterprise applications, cloud platforms, APIs, infrastructure, and AI/GenAI solutions.

The role requires hands-on experience in conducting comprehensive security assessments, penetration testing, cloud security reviews, and compliance validation activities. The candidate will work closely with development, DevOps, cloud, AI/ML, and security teams to ensure secure software delivery and maintain a strong organizational security posture.

Key Responsibilities

Vulnerability Assessment & Penetration Testing (VAPT)

• Perform vulnerability assessments and penetration testing for web applications, APIs, mobile applications, cloud environments, and enterprise systems.
• Identify security weaknesses and validate exploitability through controlled testing methodologies.
• Conduct black-box, gray-box, and white-box security assessments.
• Execute internal and external network penetration testing exercises.
• Document findings and provide detailed remediation recommendations.

Application Security Testing

• Conduct secure code reviews and application security assessments.
• Perform Dynamic Application Security Testing (DAST) and Static Application Security Testing (SAST).
• Validate application security controls and authentication mechanisms.
• Assess session management, authorization, encryption, and input validation controls.
• Ensure adherence to secure coding practices and industry standards.

OWASP Security Validation

• Evaluate applications against OWASP Top 10 security risks.
• Identify vulnerabilities such as:
• Security Misconfigurations
• Cryptographic Failures
• Cross-Site Scripting (XSS)
• Server-Side Request Forgery (SSRF)
• Conduct security reviews during development and pre-production releases.
• Support secure SDLC initiatives and security-by-design implementations.

Cloud Security Assessment

• Perform security assessments of cloud-native applications and infrastructure.
• Evaluate cloud security configurations across AWS, Azure, and Google Cloud Platform (GCP).
• Review IAM policies, network security controls, storage configurations, and encryption standards.
• Conduct cloud security posture assessments and identify misconfigurations.
• Assess container, Kubernetes, and microservices security implementations.

AI & GenAI Security Testing

• Conduct security testing of AI/ML and Generative AI applications.
• Assess AI systems for risks related to:
• Validate security controls for RAG architectures, vector databases, and LLM integrations.
• Evaluate AI governance and responsible AI security requirements.
• Develop AI-specific threat models and test scenarios.

Vulnerability Management

• Manage enterprise vulnerability assessment programs.
• Analyze scan results and prioritize remediation activities based on risk.
• Track vulnerabilities through closure using governance processes.
• Establish vulnerability reporting dashboards and KPIs.
• Coordinate with application and infrastructure teams for remediation planning.

Security Compliance & Governance

• Support compliance assessments and audits.
• Ensure security controls align with organizational security standards.
• Assist with regulatory and compliance reviews.
• Prepare evidence and documentation required for audits.
• Participate in security governance reviews and risk assessments.

Security Reporting & Risk Analysis

• Generate VAPT reports with executive summaries and technical findings.
• Present security risks and remediation strategies to stakeholders.
• Conduct threat assessments and risk analysis activities.
• Develop security metrics and reporting mechanisms.
• Support management with compliance and security posture updates.

Skill Requirements

Technical Skills Required

VAPT & Security Testing

• Vulnerability Assessment & Penetration Testing (VAPT)
• Web Application Security Testing
• Mobile Application Security Testing
• API Security Testing
• Infrastructure Security Assessment

Application Security

• SAST & DAST
• Threat Modeling
• Secure SDLC
• Security-by-Design
• DevSecOps Practices

OWASP & Security Standards

• OWASP Top 10
• OWASP API Security Top 10
• CWE/SANS Top 25
• MITRE ATT&CK Framework
• Security Control Validation
• AWS Security
• Container Security
• Cloud Security Posture Management (CSPM)
• Identity & Access Management (IAM)

AI Security

• AI/ML Security Testing
• Generative AI Security
• LLM Security Assessment
• AI Threat Modeling
• Prompt Security Validation
• AI Governance Controls
• RAG Security Testing

Vulnerability Management Tools

• Nessus
• Qualys
• Rapid7 InsightVM
• OpenVAS
• Burp Suite
• OWASP ZAP
• Nmap

Other Requirements

• Bachelor's or Master's degree in Cybersecurity, Computer Science, Information Security, or related field.
• 5+ years of experience in Vulnerability Assessment and Penetration Testing.
• Strong understanding of application security and secure development practices.
• Experience performing cloud security assessments and reviews.
• Hands-on expertise in OWASP Top 10 testing methodologies.
• Knowledge of AI/GenAI security principles and emerging threats.
• Experience working with stakeholder teams to drive remediation activities.

Preferred Certifications

• CEH (Certified Ethical Hacker)
• OSCP (Offensive Security Certified Professional)
• OSWE (Offensive Security Web Expert)
• CISSP (Certified Information Systems Security Professional)
• CCSP (Certified Cloud Security Professional)
• CompTIA Security+
• Google Professional Cloud Security Engineer
• Certified Red Team Professional (CRTP)
• Vulnerability Assessment & Penetration Testing

At HCLTech, you'll supercharge your potential. You'll find your career. And you'll find your spark. All at a place that knows that helping its customers stay on top starts by putting its people first.

HCLTech is a global technology company, home to more than 223,000 people across 60 countries, delivering industry-leading capabilities centered around digital, engineering, cloud and AI, powered by a broad portfolio of technology services and products. We work with clients across all major verticals, providing industry solutions for Financial Services, Manufacturing, Life Sciences and Healthcare, Technology and Services, Telecom and Media, Retail and CPG, and Public Services. Consolidated revenues as of 12 months ending June 2026totaled $14.8billion.