VAPT engineer

Weekday; Hyderabad; On-site; INR 3,600,000 - 7,000,000; Full time

Job summary

Weekday is seeking a VAPT Engineer in Hyderabad with 9+ years of hands-on experience in vulnerability assessment, penetration testing, and red teaming. You will design, execute, and report on comprehensive engagements across cloud, web, mobile, and network environments.

You will leverage ASR frameworks, customize tools like Burp Suite and OWASP ZAP, and mentor junior analysts while collaborating with DevSecOps to embed security testing in CI/CD pipelines.

Qualifications

• 9+ years of hands-on experience in vulnerability assessment, penetration testing, and red teaming across diverse technology stacks.
• Proficient in Automated Security Reconnaissance (ASR) tools and scripting for automation.

Responsibilities

• Conduct full-stack vulnerability assessments and penetration tests on web applications, microservices, APIs, and network infrastructure.
• Implement and customize Automated Security Reconnaissance (ASR) tools to accelerate threat surface analysis and discovery.
• Perform advanced Red Team exercises, simulating realistic attacker TTPs to evaluate detection and response capabilities.
• Analyze and interpret vulnerability scan results, prioritizing findings based on risk and business impact.
• Develop detailed exploitation PoCs and provide actionable remediation guidance to stakeholders.
• Collaborate with DevSecOps teams to integrate security testing into CI/CD pipelines and development workflows.
• Mentor junior security analysts, conducting training sessions on vulnerability tools, exploitation techniques, and secure coding practices.
• Maintain up-to-date knowledge of emerging threats, exploits, and security frameworks, updating testing methodologies accordingly.
• Generate comprehensive reports and executive summaries that translate technical findings into clear, business-relevant insights.
• Participate in incident response drills, providing expertise on breach containment, forensic analysis, and post-incident remediation.

Skills

Vulnerability assessment

Penetration testing

Red Team

ASR tools

Burp Suite

Python

CI/CD integration

Mentoring

Threat modeling

MITRE ATT&CK

Tools

Burp Suite

OWASP ZAP

Job description

This role is for one of the Weekly's clients

Salary range: Rs 3600000 - Rs 7000000 (ie INR 36-70 LPA)

Experience: 9+ yrs

Location: Hyderabad

As a VAPT Engineer, you will be responsible for designing, executing, and reporting on comprehensive vulnerability assessment and penetration testing engagements across cloud, web, mobile, and network environments. Leveraging your expertise in Automated Security Reconnaissance (ASR) frameworks, you will uncover hidden attack vectors and validate zero‑day exploits, ensuring that all findings are actionable and align with industry best practices. Your role will also involve collaborating with development and security teams to remediate identified risks, maintain threat intelligence feeds, and contribute to the evolution of the organization’s security posture. You will serve as a trusted advisor in the continuous improvement of security controls, delivering insights that influence product design, architecture resilience, and overall cyber risk strategy.

Key Responsibilities

• Conduct full-stack vulnerability assessments and penetration tests on web applications, microservices, APIs, and network infrastructure.
• Implement and customize Automated Security Reconnaissance (ASR) tools to accelerate threat surface analysis and discovery.
• Perform advanced Red Team exercises, simulating realistic adversary tactics, techniques, and procedures (TTPs) to evaluate detection and response capabilities.
• Analyze and interpret vulnerability scan results, prioritizing findings based on risk and business impact.
• Develop detailed exploitation proof‑of‑concepts (POCs) and provide actionable remediation guidance to stakeholders.
• Collaborate with DevSecOps teams to integrate security testing into CI/CD pipelines and development workflows.
• Mentor junior security analysts, conducting training sessions on vulnerability tools, exploitation techniques, and secure coding practices.
• Maintain up‑to‑date knowledge of emerging threats, exploits, and security frameworks, updating testing methodologies accordingly.
• Generate comprehensive reports and executive summaries that translate technical findings into clear, business‑relevant insights.
• Participate in incident response drills, providing expertise on breach containment, forensic analysis, and post‑incident remediation.

What makes you a great fit

• 9+ years of hands‑on experience in vulnerability assessment, penetration testing, and red teaming across diverse technology stacks.
• Deep expertise in Automated Security Reconnaissance (ASR) tools such as Burp Suite, Zap, and custom scripting.
• Proficiency in exploiting web application vulnerabilities (SQLi, XSS, CSRF, OTN, SSRF) and infrastructure weaknesses (misconfigurations, privilege escalation).
• Advanced knowledge of OWASP ASVS, NIST SP 800‑53, and CIS Controls, with proven ability to map findings to industry standards.
• Strong programming prowess in Python, Bash, PowerShell, and scripting for automation and exploitation.
• Excellent communication skills, able to translate complex technical concepts to non‑technical audiences and produce clear, actionable reports.
• Experience in Red Team simulations, including threat modeling, attack choreography, and adversary emulation frameworks such as MITRE ATT&CK.
• Demonstrated success in integrating security testing into CI/CD pipelines and SecOps workflows.
• A proactive, continuous learning mindset with active participation in security communities, capture‑the‑flag events, and vulnerability research.
• A proven track record of mentoring junior analysts and fostering a collaborative security culture.