VAPT Engineer

Ivalue Infosolutions; Bengaluru; On-site; INR 1,200,000 - 2,400,000; Full time

Job summary

Ivalue Infosolutions is seeking a skilled VAPT Engineer to perform comprehensive vulnerability assessment and penetration testing across web and mobile applications, APIs, networks, cloud environments, and infrastructure. The role requires strong cybersecurity knowledge, vulnerability identification, exploitation techniques, remediation validation, and detailed reporting.

The candidate will work across OWASP Top 10, WSTG, NIST, and other standards, using tools like Nessus, Burp Suite, ZAP, and

Qualifications

• BE/B.Tech/MCA/BSc in Computer Science, Information Technology, Cyber Security, or equivalent.
• CEH (Certified Ethical Hacker) or eJPT/PNPT certifications preferred.
• Experience in performing VAPT across web, mobile, API, network, cloud, and infrastructure domains.

Responsibilities

• Perform Web Application VAPT using OWASP WSTG methodology.
• Identify OWASP Top 10 vulnerabilities and verify findings manually.
• Conduct Mobile Application Security assessments (Android/iOS) and OWASP Mobile Top 10 testing.
• Perform API Security testing (REST/GraphQL/SOAP) and validate JWT/OAuth protections.
• Carry out Network VAPT (external/internal, firewall, VPN, wireless) and assess AD/OS security.
• Evaluate Infrastructure and Cloud security (server hardening, CIS benchmarks, IAM, storage).
• Prepare detailed VAPT reports with executive summaries, CVSS scoring, and remediation guidance.
• Provide revalidation testing and closure reports; communicate findings effectively.

Skills

Analytical thinking

Communication

Report writing

Problem solving

Time management

Team collaboration

Presentation skills

OWASP Top 10 knowledge

Security concepts

Education

BE/B.Tech

MCA

BSc in CS/IT/Cyber Security

Tools

Nessus

Qualys

Rapid7 InsightVM

OpenVAS

Nexpose

Burp Suite

OWASP ZAP

Acunetix

Netsparker

Nmap

Netcat

Wireshark

Metasploit

Hydra

Nikto

MobSF

Frida

JADX

APKTool

Drozer

Postman

Swagger

SoapUI

ScoutSuite

Prowler

AWS Inspector

Azure Defender

Job description

Job Summary

We are seeking a skilled VAPT Engineer responsible for performing comprehensive Vulnerability Assessment and Penetration Testing across web applications, mobile applications, APIs, network infrastructure, cloud environments, wireless networks, and thick client applications. The candidate should possess strong knowledge of cybersecurity principles, vulnerability identification, exploitation techniques, remediation validation, and report preparation while adhering to industry standards and best practices.

Key Responsibilities Web Application Security Testing

• Perform Web Application VAPT using OWASP WSTG methodology.
• Identify OWASP Top 10 vulnerabilities.
• Manual vulnerability verification.
• Authentication Authorization Testing.
• Session Management Testing.
• Business Logic Testing.
• Input Validation Testing.
• File Upload Security Testing.
• API Security Testing.
• Source Code Review (basic understanding).

Mobile Application Security

• Android Security Assessment.
• iOS Security Assessment.
• OWASP Mobile Top 10 Testing.
• Reverse Engineering Basics.
• Certificate Pinning Validation.
• Local Storage Assessment.
• Secure Communication Testing.

API Security Assessment

• REST API Security Testing.
• SOAP API Testing.
• GraphQL Security Assessment.
• JWT Token Testing.
• OAuth Authentication Testing.
• Rate Limiting Validation.
• Authorization Testing.
• Business Logic Testing.

Network VAPT

• External Network Assessment.
• Internal Network Assessment.
• Firewall Security Review.
• Switch Security Assessment.
• Router Security Assessment.
• VPN Security Testing.
• Wireless Security Assessment.
• Active Directory Assessment.
• Windows Security Assessment.
• Linux Security Assessment.

Infrastructure Security

• Server Hardening Validation.
• Patch Verification.
• Configuration Review.
• SSL/TLS Assessment.
• DNS Security.
• SMTP Security.
• Email Security Review.
• Database Security Assessment.

Cloud Security Assessment

• AWS Security Review.
• Azure Security Review.
• GCP Security Review.
• IAM Review.
• Security Groups.
• Storage Security.
• Cloud Configuration Assessment.
• CIS Benchmark Validation.

Wireless Security

• WPA/WPA2/WPA3 Testing.
• Rogue Access Point Detection.
• Wireless Encryption Validation.
• Wireless Authentication Testing.

Vulnerability Assessment

• Authenticated Scanning.
• Unauthenticated Scanning.
• Vulnerability Verification.
• False Positive Analysis.
• Risk Rating using CVSS v3.1.
• Remediation Recommendations.
• Revalidation Testing.

Security Standards

Knowledge of

• OWASP Top 10
• OWASP API Top 10
• OWASP Mobile Top 10
• OWASP WSTG
• NIST SP 800-115
• PTES
• CVSS v3.1
• CWE
• MITRE ATTCK
• CIS Benchmarks
• SANS Top 25
• PCI DSS
• ISO 27001
• CERT-In Guidelines

Security Tools Vulnerability Scanners

• Nessus
• Qualys
• Rapid7 InsightVM
• OpenVAS
• Nexpose

Web Security

• Burp Suite Professional
• OWASP ZAP
• Acunetix
• Netsparker

Network Tools

• Nmap
• Netcat
• Wireshark
• Metasploit
• Hydra
• Nikto

Mobile Testing

• MobSF
• Frida
• JADX
• APKTool
• Drozer

API Testing

• Postman
• Burp Suite
• Swagger
• SoapUI

Cloud Tools

• ScoutSuite
• Prowler
• AWS Inspector
• Azure Defender

Reporting Responsibilities

• Prepare detailed VAPT Reports.
• Executive Summary.
• Technical Findings.
• Proof of Concept (PoC).
• Risk Rating.
• CVSS Scoring.
• Impact Analysis.Remediation Recommendations.
• Revalidation Reports.
• Closure Reports.

Soft Skills

• Analytical Thinking.
• Strong Communication Skills.
• Report Writing.
• Customer Interaction.
• Presentation Skills.
• Time Management.
• Team Collaboration.
• Problem Solving.

Educational Qualification

• B.E./B.Tech/MCA/B.Sc. in Computer Science, Information Technology, Cyber Security, or equivalent.

Preferred Certifications

• CEH (Certified Ethical Hacker)
• eJPT
• PNPT
• CompTIA Security+
• OSCP (Preferred)
• CRTP (Preferred)
• eCPPT
• ISO 27001 Lead Implementer/Auditor (Optional)