Cyber Security Analyst

Vidal Health Insurance; Bengaluru; On-site; INR 180,000 - 300,000; Full time

Job summary

Vidal Health Insurance seeks a security professional to support GRC and VAPT activities, drafting policies, managing evidence for audits, and maintaining asset inventories. You will conduct risk assessments, review controls, and assist with remediation across on-prem and cloud environments.

The candidate will perform vulnerability assessments using Burp Suite, Nmap, OpenVAS, Nessus and Metasploit, and contribute to incident readiness and regulatory compliance initiatives.

Qualifications

• Knowledge of OWASP Top 10, CWE, CVE databases, and CVSS scoring methodology.
• Experience with vulnerability scanning platforms and interpreting automated reports.
• Familiarity with ISO 27001 control framework, risk registers, and audit evidence preparation.
• Understanding of network protocols: TCP/IP, DNS, HTTP/S, SSL/TLS and common attack vectors.
• Basic scripting in Python or Bash for task automation.

Responsibilities

• Assist in conducting risk assessments, gap analyses, and readiness reviews against ISO 27001 / NIST / SOC 2.
• Draft and update information security policies, procedures, and control documentation.
• Support internal and external audits: evidence collection, observations tracking, NCR closure.
• Monitor compliance dashboards and track regulatory change management activities.
• Maintain asset inventories and support BCP / DR planning exercises.
• Conduct vulnerability assessments and penetration tests on web apps, APIs, mobile apps, and internal networks.
• Document findings with reproduction steps, CVSS ratings, and remediation guidance.
• Participate in configuration reviews for servers, firewalls, and cloud infrastructure.

Skills

OWASP Top 10

CWE/CVE databases

CVSS scoring

vulnerability assessment

ISO 27001

risk registers

audit evidence

TCP/IP

DNS

HTTP/S

SSL/TLS

Python Bash scripting

Education

B.E./B.Tech/M.Tech/MCA in CS/IT/Cybersecurity

Tools

Burp Suite

Nmap

OpenVAS

Nessus

Metasploit

Job description

GRC Responsibilities

• Assist in conducting risk assessments, gap analyses, and readiness reviews against ISO 27001 / NIST / SOC 2


• Draft and update information security policies, procedures, and control documentation


• Support internal and external audits: evidence collection, observations tracking, NCR closure


• Monitor compliance dashboards and track regulatory change management activities


• Maintain asset inventories and support BCP / DR planning exercises

VAPT Responsibilities

• Conduct vulnerability assessments and penetration tests on web applications, APIs, mobile apps, and internal networks


• Use standard tools (Burp Suite, Nmap, OpenVAS, Nessus, Metasploit) for structured testing


• Document findings with clear reproduction steps, CVSS risk ratings, and remediation guidance


• Participate in configuration reviews for servers, firewalls, and cloud infrastructure


• Support red team or social engineering simulations under supervised engagements

Required Skills & Tools

• Working knowledge of OWASP Top 10, CWE, CVE databases, and CVSS scoring methodology


• Experience with vulnerability scanning platforms and interpreting automated reports


• Familiarity with ISO 27001 control framework, risk registers, and audit evidence preparation


• Understanding of network protocols: TCP/IP, DNS, HTTP/S, SSL/TLS and common attack vectors


• Basic scripting in Python or Bash for task automation


• Burp Suite, Nmap, OpenVAS, Nessus, Metasploit

Required Certifications

• CEH (Certified Ethical Hacker) OR OSCP (Offensive Security Certified Professional)


• ISO 27001 Lead Auditor (LA) or Lead Implementer (LI)

Education / Qualifications

• B.E. / B.Tech / M.Tech / MCA in Computer Science, Information Technology, or Cybersecurity


• 23 years of hands-on experience covering both GRC and VAPT deliverables