T&T | Cyber: D&R | Assistant Manager | Application & API Security (VAPT) | Bengaluru

Deloitte & Touche GmbH Wirtschaftsprüfungsgesellschaft; Bengaluru; On-site; INR 3,000,000 - 4,500,000; Full time

Job summary

Deloitte & Touche GmbH Wirtschaftsprüfungsgesellschaft in Bengaluru is seeking an experienced Assistant Manager - Application & API VAPT to lead application security assessments, mentor a security team, and manage customer engagements.

The ideal candidate has 4-7 years in application security and penetration testing, with at least 2 years leading teams, strong communication, and a track record in threat modeling and secure design reviews.

Qualifications

• 4-7 years in Application Security and Penetration Testing.
• Minimum 2 years leading or mentoring security teams.
• Excellent report-writing and stakeholder management.
• Strong verbal and written communication skills.
• Bachelor's or Master's degree in Computer Science or Information Security.
• Preferred certifications listed (OSCP, OSWE, eWPT, PNPT, CEH, CREST, CISSP).

Responsibilities

• Lead end-to-end VAPT engagements for web apps, APIs, mobile apps, and cloud.
• Mentor security analysts and manage multiple engagements.
• Drive remediation discussions with owners and development teams.
• Participate in security reviews with executives and stakeholders.

Skills

Experience in Application Security & P

Leadership & mentoring

Report-writing

Stakeholder management

Verbal & written communication

Education

Bachelor's or Master's in CS/Info Security

Tools

OSCP

OSWE

eWPT/eWPTX

PNPT

CEH/CREST/CISSP

Job description

Select how often (in days) to receive an alert:

The team

Deloitte helps organizations prevent cyberattacks and protect valuable assets. We believe in being secure, vigilant, and resilient—not only by looking at how to prevent and respond to attacks, but at how to manage cyber risk in a way that allows you to unleash new opportunities. Embed cyber risk at the start of strategy development for more effective management of information and technology risks.Learn moreabout Cybersecurity

We are looking for an experiencedAssistant Manager - Application & API VAPT with 4-7 years of hands-on penetration testing experience to lead application security assessments, mentor team members, and manage customer engagements. The candidate should possess strong technical expertise in offensive security, application penetration testing, API security testing, and vulnerability management while being capable of driving security initiatives and stakeholder communications.

• Lead and perform end-to-end Vulnerability Assessment and Penetration Testing (VAPT) engagements for:
• Web Applications
• APIs (REST, SOAP, GraphQL)
• Mobile Applications (iOS & Android)
• Cloud-hosted Applications
• Microservices-based Architectures
• Execute advanced penetration testing techniques to identify and exploit:
• Conduct manual penetration testing beyond automated scanner findings.
• Perform threat modeling and attack surface analysis.
• Validate vulnerabilities identified through SAST, DAST, and SCA tools.
• Conduct secure architecture and security design reviews.
• Perform cloud application security assessments on Azure, AWS, and GCP environments.
• Support container and Kubernetes security assessments.

Leadership & Management Responsibilities

• Manage and lead a team of VAPT consultants and security analysts.
• Review penetration testing reports and ensure quality deliverables.
• Allocate resources and manage multiple assessment engagements.
• Mentor junior team members on offensive security methodologies and best practices.
• Drive remediation discussions with application owners and development teams.
• Participate in customer and executive-level security review meetings.
• Track assessment metrics, remediation status, and risk reduction initiatives.

Core Penetration Testing Skills Required

Application Security

• Strong understanding of:
• OWASP Top 10
• OWASP API Security Top 10
• MITRE ATT&CK Framework
• CWE/SANS Top 25
• Mobile Application Security Testing
• Authentication and Access Control Testing
• Session Management Testing
• Business Logic Testing
• Source Code Assisted Testing

Infrastructure Security Knowledge

• Active Directory Security Assessments
• Internal and External Network Assessments
• Cloud Security Assessments
• Container Security Testing

Key Skills Required:

• 4-7 years of experience in Application Security and Penetration Testing.
• Minimum 2 years of experience leading or mentoring security teams.
• Excellent report-writing and stakeholder management skills.
• Strong verbal and written communication skills.
• Bachelor's orMaster's degree in Computer Science, Information Security, or related field.
• Preferred Certifications : OSCP (Offensive Security Certified Professional)
• OSWE (Offensive Security Web Expert)
• eWPT / eWPTX / PNPT / CEH / CREST Certifications/ CISSP (Preferred for leadership positions)