Vulnerability Assessment & Penetration Testing (VAPT) Engineer

Zensar; Pune District; On-site; INR 1,200,000 - 2,800,000; Full time

Job summary

Zensar Technologies in Pune is seeking a highly skilled VAPT Engineer to lead security assessments of web applications, APIs, and enterprise systems. You will perform both manual and automated testing, analyze architecture for weaknesses, and report findings with remediation guidance to development and operations teams.

Key tools include Burp Suite Professional and OWASP ZAP, with experience in Nmap and Metasploit a plus.

Qualifications

• 3–8 years of relevant experience in web app security and penetration testing.

Responsibilities

• Perform Web Application VAPT and identify security vulnerabilities across business-critical applications.

Skills

Web Application VAPT

API VAPT

Application Security Testing

OWASP Top 10 (Web Applications)

OWASP API Security Top 10

Burp Suite Professional

OWASP ZAP

Manual Penetration Testing

Security Assessment & Reporting

Secure Coding Principles

Threat Modeling

Vulnerability Management

Education

Bachelor's Degree in Computer Science, Information Security, Information Technology, or related field

Tools

Burp Suite

OWASP ZAP

Nmap

Metasploit

Job description

Greetings from Zensar Technologies, Pune

Position: VAPT Engineer / Senior VAPT Engineer
Location: Pune

Work Mode: Work from Office (5 Days a Week)

About the Role :

We are seeking a highly skilled Vulnerability Assessment & Penetration Testing (VAPT) Engineer to join our Cyber Security team. The ideal candidate will be responsible for conducting comprehensive security assessments of web applications, APIs, and enterprise applications to identify vulnerabilities and recommend remediation measures. The role requires strong expertise in offensive security testing, application security, and secure coding practices.

Key Responsibilities :

Vulnerability Assessment & Penetration Testing:

• Perform Web Application VAPT and identify security vulnerabilities across business-critical applications.
• Conduct API Security Assessments and penetration testing of REST/SOAP APIs.
• Execute manual and automated security testing using industry-standard tools.
• Analyze application architecture and identify potential security weaknesses.
• Perform authentication, authorization, session management, input validation, and business logic testing.
• Validate vulnerability fixes and conduct re-testing activities.

Application Security:

• Assess applications against OWASP Top 10 Web Application Security Risks.
• Assess APIs against OWASP API Security Top 10.
• Identify and report vulnerabilities such as:
  • SQL Injection
  • Cross-Site Scripting (XSS)
  • Cross-Site Request Forgery (CSRF)
  • SSRF
  • Authentication & Authorization flaws
  • Broken Access Control
  • API Security vulnerabilities
  • Security Misconfigurations
  • Sensitive Data Exposure

Reporting & Stakeholder Management:

• Prepare detailed technical and executive VAPT reports.
• Provide risk ratings, remediation recommendations, and proof-of-concept findings.
• Collaborate with development, DevOps, and infrastructure teams to address security vulnerabilities.
• Conduct security awareness sessions and share best practices with development teams.

Required Skills

• Web Application VAPT
• API VAPT
• Application Security Testing
• OWASP Top 10 (Web Applications)
• OWASP API Security Top 10
• Burp Suite Professional
• OWASP ZAP
• Manual Penetration Testing
• Security Assessment & Reporting
• Secure Coding Principles
• Threat Modeling
• Vulnerability Management

Preferred Certifications

• OSCP (Offensive Security Certified Professional) Preferred
• CEH ANSI
• CEH Practical
• GWAPT
• GPEN
• Security+ (Good to Have)

Experience:

• 3 to 8 years of relevant experience in Web Application Security and Penetration Testing.
• Hands-on experience conducting VAPT engagements independently.
• Practical experience with Burp Suite, OWASP ZAP, Nmap, Metasploit, and related security tools.
• Experience working with SDLC, DevSecOps, and secure application development practices is preferred.

Educational Qualification:

• Bachelor's Degree in Computer Science, Information Security, Information Technology, or related field.
• Relevant Cyber Security certifications will be an added advantage.

Mandatory Skills Checklist:

• Web Application VAPT
• API VAPT
• OWASP Top 10 for Web Applications
• OWASP API Security Top 10
• Application Security
• Burp Suite
• OWASP ZAP
• CEH ANSI / CEH Practical
• OSCP (Preferred)