T&T | Cyber: D&R | Consultant | Application & API Security (VAPT) | Bengaluru

Deloitte & Touche GmbH Wirtschaftsprüfungsgesellschaft; Bengaluru; Presencial; INR 1 200 000 - 1 800 000; Tempo integral

Resumo da oferta

Deloitte & Touche GmbH Wirtschaftsprüfungsgesellschaft is seeking a highly motivated Application & API VAPT Analyst with 3 to 5 years of experience to assess security across web, mobile, APIs and cloud-hosted apps. You will identify vulnerabilities, validate findings, and provide remediation guidance while collaborating with development, DevOps and architecture teams.

The role requires hands-on testing of REST, SOAP, GraphQL, and microservices, adherence to OWASP standards, and participation in

Qualificações

• Bachelor's or Master's degree in Computer Science, Information Security, Cybersecurity, or related field.
• Relevant cybersecurity certifications preferred.
• Professional is required to work from office.

Responsabilidades

• Perform VAPT on web, mobile, APIs and microservices.
• Test aligned with OWASP Top 10, OWASP API Top 10, SANS Top 25 and CWE.
• Identify, exploit and validate vulnerabilities such as auth issues, XSS, SSRF, IDOR, CSRF, RCE and BI.
• Perform manual testing in addition to automated scanning.
• Review source/code findings and validate weaknesses where applicable.
• Assess REST, SOAP, GraphQL, and microservice APIs.
• Prepare detailed VAPT reports with risk ratings and PoCs.
• Conduct remediation validation and re-testing.
• Collaborate with development, DevOps and architecture teams.
• Support secure SDLC activities and DevSecOps initiatives.
• Participate in threat modeling and security design reviews.
• Provide security guidance to application development teams.

Conhecimentos

VAPT

OWASP Top10

OWASP API Top10

REST/GraphQL testing

Burp Suite

OWASP ZAP

Postman

Nmap

Nessus

SQLMap

CI/CD/DevSecOps familiarity

Cloud security concepts

CEH

eWPT

OSCP

PNPT

Formação académica

Bachelor's or Master's degree in Computer Science / Information Security / Cybersecurity

Ferramentas

Burp Suite Professional

OWASP ZAP

Postman

Nmap

Nessus

Nikto

SQLMap

Descrição da oferta de emprego

The team

Select how often (in days) to receive an alert:

Deloitte helps organizations prevent cyberattacks and protect valuable assets. We believe in being secure, vigilant, and resilient—not only by looking at how to prevent and respond to attacks, but at how to manage cyber risk in a way that allows you to unleash new opportunities. Embed cyber risk at the start of strategy development for more effective management of information and technology risks.Learn moreabout Cybersecurity

We are seeking a highly motivated and skilled Application & API VAPT (Vulnerability Assessment and Penetration Testing) Analyst with 3 to 5 years of experience in identifying, assessing, and validating security vulnerabilities across web applications, mobile applications, APIs, and cloud-hosted applications. The candidate will be responsible for conducting security assessments, supporting remediation efforts, and helping enhance the organization's security posture.

• PerformVulnerability Assessments and Penetration Testing (VAPT) on web applications, mobile applications, APIs, and microservices.
• Conduct security testing aligned with OWASP Top 10, OWASP API Security Top 10, SANS Top 25, and CWE standards.
• Identify, exploit, and validate security vulnerabilities such as:
• Authentication and Authorization flaws
• Cross-Site Scripting (XSS)
• Server-Side Request Forgery (SSRF)
• Insecure Direct Object References (IDOR)
• Cross-Site Request Forgery (CSRF)
• Remote Code Execution (RCE)
• Business Logic Vulnerabilities
• Perform manual security testing in addition to automated scanning.
• Review source code findings and validate security weaknesses where applicable.
• Assess REST, SOAP, GraphQL, and microservice-based APIs.
• Prepare detailed VAPT reports with risk ratings, proof of concepts, and remediation recommendations.
• Conduct remediation validation and re-testing of identified vulnerabilities.
• Collaborate with development, DevOps, and architecture teams to drive security improvements.
• Support secure SDLC activities and DevSecOps initiatives.
• Participate in threat modeling and security design reviews.
• Provide security guidance and awareness to application development teams.

Key Skills Required:

• 2-5 years of hands-on experience in Application Security and VAPT.
• Strong understanding of:
• OWASP Top 10
• OWASP API Security Top 10
• HTTP/HTTPS protocols
• Session Management and Access Controls
• Hands-on experience with tools such as:
• Burp Suite Professional
• OWASP ZAP
• Postman
• Nmap
• Nessus
• Nikto
• SQLMap
• Experience testing APIs, Single Page Applications (SPA), and cloud-native applications.
• Familiarity with CI/CD and DevSecOps practices.
• Basic understanding of AWS, Azure, or GCP security concepts.
• Ability to analyze application architecture and identify attack vectors.
• CEH (Certified Ethical Hacker)
• eWPT (eLearnSecurity Web Application Penetration Tester)
• OSCP (Offensive Security Certified Professional)
• PNPT or equivalent offensive security certifications
• Knowledge of secure coding practices and code review methodologies
• Bachelor's or Master's degree in Computer Science, Information Security, Cybersecurity, or related field.
• Relevant cybersecurity certifications preferred.
• Professional is required to work from office