T&T | Cyber: D&R | Assistant Manager | VAPT | Bengaluru

Deloitte & Touche GmbH Wirtschaftsprüfungsgesellschaft; Bengaluru; Sur place; INR 1 800 000 - 3 000 000; Plein temps

Résumé du poste

Deloitte & Touche GmbH Wirtschaftsprüfungsgesellschaft is seeking an experienced Assistant Manager for Application & API VAPT to lead security assessments and mentor a team. You will manage client engagements, perform deep vulnerability testing across web, APIs, mobile apps, and cloud environments, and drive risk reduction through remediation discussions with stakeholders.

The role requires strong offensive security expertise, knowledge of OWASP, MITRE ATT&CK, and cloud security, with a proven

Qualifications

• 4–7 years of hands-on application security and penetration testing experience.
• Experience leading or mentoring security teams for 2+ years.
• Strong report writing and stakeholder management skills.

Responsabilités

• Lead end-to-end VAPT engagements for web apps, APIs, mobile apps, and cloud apps.
• Mentor team members and manage customer engagements and expectations.
• Drive remediation discussions with owners and development teams.
• Review reports for quality and coordinate resource allocation.
• Engage in threat modeling, attack surface analysis, and security design reviews.

Connaissances

OWASP Top 10

OWASP API Security Top 10

MITRE ATT&CK Framework

CWE/SANS Top 25

Mobile Application Security Testing

Authentication and Access Control

Session Management Testing

Business Logic Testing

Source Code Assisted Testing

Formation

Bachelor’s or Master’s degree in Computer Science/Information Security

Outils

SAST Tools

DAST Tools

SCA Tools

Azure

AWS

GCP

Kubernetes

Docker

Description du poste

Deloitte helps organizations prevent cyberattacks and protect valuable assets. We believe in being secure, vigilant, and resilient—not only by looking at how to prevent and respond to attacks, but at how to manage cyber risk in a way that allows you to unleash new opportunities. Embed cyber risk at the start of strategy development for more effective management of information and technology risks. Learn moreabout Cybersecurity

The team

We are looking for an experienced Assistant Manager - Application & API VAPT with 4-7 years of hands‑on penetration testing experience to lead application security assessments, mentor team members, and manage customer engagements. The candidate should possess strong technical expertise in offensive security, application penetration testing, API security testing, and vulnerability management while being capable of driving security initiatives and stakeholder communications.

• Lead and perform end-to-end Vulnerability Assessment and Penetration Testing (VAPT) engagements for:
• Web Applications
• APIs (REST, SOAP, GraphQL)
• Mobile Applications (iOS & Android)
• Cloud-hosted Applications
• Microservices-based Architectures
• Execute advanced penetration testing techniques to identify and exploit:
• Conduct manual penetration testing beyond automated scanner findings.
• Perform threat modeling and attack surface analysis.
• Validate vulnerabilities identified through SAST, DAST, and SCA tools.
• Conduct secure architecture and security design reviews.
• Perform cloud application security assessments on Azure, AWS, and GCP environments.
• Support container and Kubernetes security assessments.

Leadership & Management Responsibilities

• Manage and lead a team of VAPT consultants and security analysts.
• Review penetration testing reports and ensure quality deliverables.
• Allocate resources and manage multiple assessment engagements.
• Mentor junior team members on offensive security methodologies and best practices.
• Drive remediation discussions with application owners and development teams.
• Participate in customer and executive-level security review meetings.
• Track assessment metrics, remediation status, and risk reduction initiatives.

Core Penetration Testing Skills Required

Application Security

• Strong understanding of:
• OWASP Top 10
• OWASP API Security Top 10
• MITRE ATT&CK Framework
• CWE/SANS Top 25
• Mobile Application Security Testing
• Authentication and Access Control Testing
• Session Management Testing
• Business Logic Testing
• Source Code Assisted Testing

Infrastructure Security Knowledge

• Active Directory Security Assessments
• Internal and External Network Assessments
• Cloud Security Assessments
• Container Security Testing

Key Skills Required:

• 4-7 years of experience in Application Security and Penetration Testing.
• Minimum 2 years of experience leading or mentoring security teams.
• Excellent report‑writing and stakeholder management skills.
• Strong verbal and written communication skills.
• Bachelor’s orMaster’s degree in Computer Science, Information Security, or related field.
• Preferred Certifications : OSCP (Offensive Security Certified Professional)
• OSWE (Offensive Security Web Expert)
• eWPT / eWPTX / PNPT / CEH / CREST Certifications/ CISSP (Preferred for leadership positions)