Vapt Engineer

Brace Technologies Pvt LTD; Hyderabad; Hybrid; INR 900,000 - 1,500,000; Full time

Job summary

Brace Technologies Pvt LTD in Hyderabad is seeking an IT Security Engineer with extensive hands-on experience in Vulnerability Assessment and Penetration Testing (VAPT) across web apps, APIs, and software components. The role emphasizes DAST, SAST, SCA, Burp Suite, and knowledge of XSS, OWASP Top 10, and secure coding practices.

You will perform VAPT on diverse environments, conduct both manual and automated testing, and collaborate with DevOps and development teams to remediate findings.

Qualifications

• 35+ years of experience? (noted text mentions 36 years) in Vulnerability Assessment and Penetration Testing (VAPT).
• Hands-on in identifying, analyzing, validating, and reporting security vulnerabilities across web apps, APIs, and software components.
• Strong expertise in VAPT, penetration testing, DAST, SAST, SCA, Burp Suite, and XSS, plus OWASP Top 10 and secure coding practices.

Responsibilities

• Perform VAPT on web applications, APIs, and application environments.
• Conduct manual and automated penetration testing to identify security weaknesses.
• Perform DAST to identify runtime vulnerabilities.
• Perform SAST to detect flaws in source code.
• Conduct SCA to identify vulnerable open-source libraries and dependencies.
• Use Burp Suite for testing, vulnerability validation, and penetration testing.
• Identify, exploit safely, and validate XSS, SQLi, CSRF, IDOR, SSRF, and misconfigurations.
• Assess apps against OWASP Top 10 and security standards.
• Analyze scan results, filter false positives, assess risk, prioritize findings.

Skills

VAPT

Penetration Testing

DAST

SAST

SCA

Burp Suite

XSS

OWASP Top 10

Secure Coding

Tools

Burp Suite

Job description

Role & responsibilities

Job Summary

We are looking for a skilled IT Security Engineer with 36 years of experience in Vulnerability Assessment and Penetration Testing (VAPT), application security, and vulnerability management. The ideal candidate will have hands‑on experience in identifying, analyzing, validating, and reporting security vulnerabilities across web applications, APIs, and software components.

The candidate should have strong expertise in VAPT, penetration testing, DAST, SAST, SCA, Burp Suite, and Cross‑Site Scripting (XSS), along with a solid understanding of web application security, OWASP Top 10, and secure coding practices.

Key Responsibilities

• Perform Vulnerability Assessment and Penetration Testing (VAPT) on web applications, APIs, and other application environments.
• Conduct manual and automated penetration testing to identify security weaknesses and exploitable vulnerabilities.
• Perform DAST (Dynamic Application Security Testing) to identify runtime vulnerabilities in applications.
• Perform SAST (Static Application Security Testing) to detect security flaws in source code.
• Conduct SCA (Software Composition Analysis) to identify vulnerable open‑source libraries, third‑party dependencies, and software components.
• Use Burp Suite extensively for web application security testing, request manipulation, vulnerability validation, and penetration testing.
• Identify, exploit safely, and validate vulnerabilities such as Cross‑Site Scripting (XSS), SQL Injection, CSRF, IDOR/Broken Access Control, SSRF, authentication flaws, and security misconfigurations.
• Assess applications against the OWASP Top 10 and relevant application security standards.
• Analyze vulnerability scan results, eliminate false positives, assess risk, and prioritize findings based on severity and business impact.
• Prepare detailed security assessment reports with proof of concept, risk ratings, remediation recommendations, and mitigation strategies.
• Collaborate with developers, DevOps, QA, and infrastructure teams to resolve identified vulnerabilities.
• Conduct retesting and remediation validation to ensure reported vulnerabilities have been effectively addressed.
• Support secure SDLC practices and integrate security testing tools into CI/CD pipelines.
• Stay updated on emerging vulnerabilities, attack techniques, security advisories, and industry best practices