VAPT Consultant

Pratyin Infotech; Shillong; Presencial; INR 600.000 - 1.200.000; Jornada completa

Descripción de la vacante

Pratyin Infotech in Shillong, India, is seeking a hands-on VAPT Engineer to perform vulnerability assessments and penetration testing across web apps, APIs, networks, and IT infrastructure.

You will apply manual testing techniques, validate findings, and prepare detailed reports with remediation guidance, while collaborating with development and security teams to close gaps and improve overall security posture.

Formación

• Hands-on experience in VAPT and manual penetration testing.
• Knowledge of web application, API, network and infrastructure security testing.
• Experience with Burp Suite, OWASP ZAP, Nessus/Tenable, Nmap, Metasploit, Kali Linux and Postman.
• Understanding of OWASP Top 10 and WSTG.

Responsabilidades

• Perform Vulnerability Assessment and Penetration Testing (VAPT) for web applications, APIs, networks, and IT infrastructure.
• Conduct authenticated and unauthenticated vulnerability assessments to identify security weaknesses.
• Execute manual penetration testing to validate vulnerabilities and assess exploitability.
• Identify and validate security vulnerabilities, including OWASP Top 10 risks and common network weaknesses.
• Prepare detailed VAPT reports with severity, evidence, risk impact and remediation recommendations.
• Collaborate with development, infrastructure, and security teams to remediate findings.
• Perform retesting after remediation and verify vulnerability closure.
• Support secure code review and application security assessments.
• Maintain VAPT documentation, testing procedures, and assessment records.
• Support security compliance audits and assessments per standards and policies.

Conocimientos

VAPT expertise

Manual pentesting

Security testing

Herramientas

Burp Suite

OWASP ZAP

Nessus/Tenable

Nmap

Metasploit

Kali Linux

Postman

Descripción del empleo

Job Responsibilities VAPT Engineer

• Perform Vulnerability Assessment and Penetration Testing (VAPT) for web applications, APIs, networks, and IT infrastructure.


• Conduct authenticated and unauthenticated vulnerability assessments to identify security weaknesses.


• Execute manual penetration testing to validate vulnerabilities and assess their exploitability.


• Use security testing tools such as Burp Suite, OWASP ZAP, Nessus/Tenable, Nmap, Metasploit, Kali Linux, and Postman.


• Identify and validate security vulnerabilities, including OWASP Top 10 risks and common network security weaknesses.


• Prepare detailed VAPT reports covering identified vulnerabilities, severity levels, technical evidence, risk impact, and remediation recommendations.


• Collaborate with development, infrastructure, and security teams to support vulnerability remediation.


• Perform retesting after remediation and verify vulnerability closure.


• Support secure code review and application security assessments.


• Maintain VAPT documentation, testing procedures, and assessment records.


• Support security compliance audits and assessments in accordance with applicable security standards and organizational policies.


• Ensure all penetration testing activities are conducted within the approved scope and follow established security testing methodologies.

Required Technical Skills

• Hands-on experience in VAPT and manual penetration testing.


• Knowledge of web application, API, network, and infrastructure security testing.


• Experience with Burp Suite, OWASP ZAP, Nessus/Tenable, Nmap, Metasploit, Kali Linux, and Postman.


• Understanding of OWASP Top 10 and OWASP Web Security Testing Guide (WSTG).


• Ability to prepare technical VAPT reports and recommend remediation measures.


• Experience with vulnerability validation, remediation tracking, and retesting.

Preferred Candidate Profile

Candidates with practical experience executing penetration tests, validating vulnerabilities, preparing technical reports, and conducting remediation retesting are preferred. Candidates with experience limited to GRC, compliance, or reviewing third-party VAPT reports may not be suitable for this hands-on role.